Server-Side Request Forgery in WP CTA Plugin by WordPress
CVE-2026-6089

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Cta – Call Now Button, Sticky Button & Call To Action Builder
Vendor
CVE Published:
29 July 2026

What is CVE-2026-6089?

The WP CTA plugin in WordPress presents a significant security risk due to a Server-Side Request Forgery vulnerability. This flaw arises from the handling of the 'sticky_s_media' parameter in JSON file imports. The import_sidebars() function inadequately validates user-supplied URLs, allowing authenticated attackers with Administrator-level access to issue web requests to internal services. This access can lead to potentially sensitive internal data being queried and modified, as the response content is stored as a WordPress media attachment, exacerbating the severity of the exposure.

Affected Version(s)

WP CTA – Call Now Button, Sticky Button & Call to Action Builder 2.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/easy-sticky-si...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Quang Truong
Chu Thao Mai
.