Cross-Site Request Forgery Vulnerability in MMA Call Tracking Plugin for WordPress

CVE-2026-1215

What is CVE-2026-1215?

The MMA Call Tracking plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) attacks due to insufficient nonce validation when saving configurations on the admin page. This vulnerability allows attackers to exploit the weakness by crafting a malicious request that, if executed by an unsuspecting site administrator, could result in unauthorized changes to the call tracking settings. Any version of the plugin up to and including 2.3.15 is affected, making it imperative for users to apply vendor-recommended security practices to mitigate possible exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References