Data Exposure Vulnerability in Call Now Button Plugin for WordPress

CVE-2025-11632

What is CVE-2025-11632?

The Call Now Button plugin for WordPress is susceptible to unauthorized data access due to a lack of capability checks across several functions. This vulnerability affects all versions up to and including 1.5.4, allowing attackers with Subscriber-level access and higher to exploit this weakness. They can generate links to the billing portal, gaining access to sensitive information such as billing details and domain status or creating chat session tokens. A partial fix was implemented in version 1.5.4, with a complete resolution introduced in 1.5.5. It is crucial for site administrators to update their plugins to mitigate this security risk effectively.

References