The Call To Action Plugin for WordPress suffers from a CSRF vulnerability due to missing nonce validation in the cbox_options_page() function. The plugin does not include a wp_nonce_field() in the settings form nor verify the nonce upon saving settings, allowing attackers to forge requests that modify plugin configuration without authentication. This affects all versions up to and including 3.1.3. The vulnerability allows an attacker to alter various plugin settings by tricking an administrator into clicking a crafted link. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily on integrity with no confidentiality or availability impact.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability, potentially altering the call-to-action box's title, content, URLs, images, colors, and other configurations. This could mislead site visitors or degrade the intended functionality of the plugin. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when clicking links and consider limiting access to the plugin settings page to trusted users only. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.