Vulnerability · Published Oct 29, 2025 · Assigned by Wordfence
CVE-2025-11587Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update
Medium 4.3
In plain English
A medium-severity missing authorization in Call Now Button – The #1 Click to Call Button for WordPress from jgrietveld. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jgrietveld | Call Now Button – The #1 Click to Call Button for WordPress | 0 – through 1.5.3 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N