CVE-2025-11632

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Call Now Button plugin for WordPress up to version 1.5.4 has missing capability checks on multiple functions, allowing authenticated users with Subscriber-level access and above to access data such as billing portal links, chat session tokens, domain status, and modify billing information. Partially fixed in 1.5.4 and fully fixed in 1.5.5.

Risk Assessment

The organization may face exposure of billing data and unauthorized account modifications, potentially leading to financial loss and privacy breaches.

Recommendation

Immediately update the plugin to version 1.5.5 or later and review logs for unauthorized activities.

Other vulnerabilities in Call Now Button

CVE-2025-11587Medium
The Call Now Button plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to and including 1.5.3. This allows authenticated attackers with Subscriber-level access and above to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.

Original NVD description (English source)

The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate links to billing portal, where they can view and modify billing information of the connected, account, generate chat session tokens, view domain status, etc. This vulnerability was partially fixed in version 1.5.4 and fully fixed in version 1.5.5

Vulnerability data from NVD (NIST) · CISA KEV · EPSS