PT-2025-44274 · WordPress+1 · Call Now Button+1

Dmitry Ignatyev · Published 2025-10-29 · Updated 2025-10-29 · CVE-2025-11587

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Call Now Button – The #1 Click to Call Button for WordPress plugin versions prior to 1.5.4

Description The plugin is susceptible to unauthorized data modification because of a missing capability check within the activate function. This allows authenticated attackers with Subscriber-level access or higher to associate the plugin with a nowbuttons.com account and introduce malicious buttons to the website. The issue is exploitable only on new installations where the plugin hasn't been configured with an API key.

Recommendations Update to version 1.5.4 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11587

Affected Products

Call Now Button

Nowbuttons.Com

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11587 · Security Note
• https://twitter.com/CVEnew/status/1983522118362181875 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d77b127e-52ee-4256-9450-410413b273f6?source=cve · Note
• https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/api-key/class-ott-controller.php#L27 · Note
• https://twitter.com/VulmonFeeds/status/1983620059151946218 · Twitter Post
• https://research.cleantalk.org/cve-2025-11587 · Note