WP CTA Call To Action Plugin Missing Authorization Vulnerability

A vulnerability exists in the WP CTA – Call To Action Plugin, specifically in the Sticky CTA and Sticky Buttons components, for WordPress versions through 1.7.0. The issue arises from a lack of proper capability checks in the 'update_cta_status' and 'change_sticky_sidebar_name' functions. This flaw allows unauthenticated attackers to modify the status of sticky items and change the names displayed in the WP CTA Dashboard backend.

Impact

Exploitation of this vulnerability allows for unauthorized users to modify sticky item statuses and names within the WP CTA Dashboard, potentially leading to misleading information or improper content promotion.

Remediation

Users are advised to update the WP CTA – Call To Action Plugin to version 1.7.1 or later, where this vulnerability has been patched.