CVE-2025-8152

Name of the Vulnerable Software and Affected Versions WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons versions prior to 1.7.1

Description The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check. Specifically, the update cta status and change sticky sidebar name functions lack proper authorization controls. This allows unauthenticated attackers to modify the status of sticky call-to-action buttons and update the name displayed in the WordPress CTA Dashboard.

Recommendations Update WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons to version 1.7.1 or later.