Unauthorized Data Modification in WP CTA Plugin for WordPress

CVE-2025-8152

What is CVE-2025-8152?

The WP CTA – Call To Action Plugin and related plugins are vulnerable to unauthorized data modification due to a lack of capability checks in critical update functions. This vulnerability affects all versions up to and including 1.7.0, allowing unauthenticated attackers to manipulate the status of 'sticky' elements and alter names displayed in the WordPress dashboard. The absence of proper validation creates opportunities for malicious actions, potentially compromising the integrity of site configurations and user interfaces.

References