tmarek vulnerabilities and threats

CVE-2026-4118 is a Cross-Site Request Forgery (CSRF) vulnerability in the tmarek Call To Action Plugin for WordPress, affecting all versions up to 3.1.3. The vulnerability arises because the plugin's settings page lacks nonce validation, allowing unauthenticated attackers to modify plugin settings if they can trick an administrator into performing an action such as clicking a malicious link. This can lead to unauthorized changes to call-to-action box title, content, link URL, image URL, colors, and other configuration options. The CVSS score is 4.3, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.