Unauthorized Data Modification in Call Now Button for WordPress by WordPress

CVE-2025-11587

What is CVE-2025-11587?

The Call Now Button plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and higher to exploit the absence of a capability check in the activate function. This issue enables these attackers to associate the plugin with their nowbuttons.com account and potentially inject malicious elements into the site. It is important to note that this vulnerability is only applicable to new installations where the plugin has not been set up with a pre-configured API key.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References