Unauthorized Data Modification in Call Now Button for WordPress by WordPress

CVE-2025-11587

What is CVE-2025-11587?

The Call Now Button plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and higher to exploit the absence of a capability check in the activate function. This issue enables these attackers to associate the plugin with their nowbuttons.com account and potentially inject malicious elements into the site. It is important to note that this vulnerability is only applicable to new installations where the plugin has not been set up with a pre-configured API key.

References