Indeed, the SpongeWrap paper does not claim CPA security (or, really, any kind of privacy protection at all) unless a nonce is included in the associated data, or the associated data can otherwise be guaranteed to be unique for each message. In particular, if you look closely at section 2.2, you'll find the following note at the end of page 3:
For privacy, we consider only adversaries who respect the nonce requirement. For a single header-body pair, it means that, for any two queries $(A, B)$ and $(A′, B′)$, we have $A = A′ ⇒ B = B′$. In general, the nonce requirement specifies that for any two queries $(\overline{A, B})$ and $(\overline{A′, B′})$ of equal length $n$, we have $${\rm pre}(\overline{A, B}) = {\rm pre}(\overline{A′, B′}) ⇒ B^{(n)} = B′^{(n)},$$ with ${\rm pre}(\overline{A, B}) = (A^{(1)}, B^{(1)}, A^{(2)}, \dots , B^{(n−1)}, A^{(n)})$ the sequence with the last body omitted. As for a stream cipher, not respecting the nonce requirement means that the adversary can learn the bitwise difference between two plaintext bodies.
