Executive brief
The WP CTA plugin for WordPress, which is used to create call-to-action buttons and sticky sidebars, contains a security flaw in its data import feature. An authorized administrator could upload a specially crafted file that forces the website to make internal network requests. This could allow an attacker to view sensitive information from internal services that are not normally accessible from the internet.
Technical details
The WP CTA plugin for WordPress is vulnerable to a full-read Server-Side Request Forgery (SSRF) due to insufficient validation in the import_sidebars() function. The function uses FILTER_VALIDATE_URL on user-supplied URLs from imported JSON data before passing them to file_get_contents(), which fails to block internal IP addresses. An authenticated attacker with Administrator-level privileges can exploit this to make arbitrary web requests from the server. Because the response content is saved as a WordPress media attachment, the attacker can read the results of these requests, potentially exposing sensitive data from internal services or the local network.
Affected products
- blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder <= 2.1.2
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
References
- https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/import-export.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3491924%40easy-sticky-sidebar%2Ftrunk&old=3459250%40easy-sticky-sidebar%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/df5fc86f-e4ba-424b-bece-79abd763cf74?source=cve