CVE-2025-11587

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Call Now Button plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to and including 1.5.3. This allows authenticated attackers with Subscriber-level access and above to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.

Risk Assessment

An attacker can take control of the plugin and add malicious buttons, potentially leading to phishing or other attacks on users. The limitation is that it requires a fresh installation.

Recommendation

Update the plugin to the latest patched version. Additionally, after installation, configure the plugin with an API key and restrict user permissions.

Other vulnerabilities in Call Now Button

CVE-2025-11632Medium
The Call Now Button plugin for WordPress up to version 1.5.4 has missing capability checks on multiple functions, allowing authenticated users with Subscriber-level access and above to access data such as billing portal links, chat session tokens, domain status, and modify billing information. Partially fixed in 1.5.4 and fully fixed in 1.5.5.

Original NVD description (English source)

The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS