CVE-2025-11587: Call Now Button WordPress Auth Bypass Flaw

CVE-2025-11587 Overview

CVE-2025-11587 is a missing authorization vulnerability in the Call Now Button WordPress plugin, affecting all versions up to and including 1.5.3. The plugin fails to enforce a capability check on the activate function within class-ott-controller.php. Authenticated attackers with Subscriber-level access or higher can link the plugin to an attacker-controlled nowbuttons.com account and inject malicious call buttons into the target site. Exploitation is limited to fresh installations where the plugin has not yet been configured with an API key. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact

Low-privileged subscribers can hijack the plugin configuration on unconfigured installs, replacing legitimate click-to-call buttons with attacker-controlled content that reaches every site visitor.

Affected Products

• Call Now Button – The #1 Click to Call Button for WordPress plugin
• All plugin versions through 1.5.3
• WordPress sites with the plugin installed but not yet linked to a nowbuttons.com account

Discovery Timeline

• 2025-10-29 - CVE-2025-11587 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11587

Vulnerability Analysis

The Call Now Button plugin exposes an activation endpoint that binds the WordPress installation to a remote nowbuttons.com account through an API key. The endpoint handler in class-ott-controller.php around line 27 processes the linking request without validating that the requesting user holds an administrative capability such as manage_options. Any authenticated user, including a Subscriber, can invoke the endpoint and complete the pairing. Once paired, the attacker controls the remote configuration and can push arbitrary button definitions to the site, including malicious destinations. The impact scope maps to integrity loss for the plugin configuration and any visitor interacting with the injected buttons.

Root Cause

The root cause is a missing capability check on a state-changing REST/AJAX action. WordPress requires plugin authors to call current_user_can() or an equivalent guard before mutating options. The activate function omits this check and relies solely on nonce or authentication context, which any logged-in user can satisfy. Combined with the plugin storing the linked account and button payload in site options, the missing guard converts an internal setup routine into a privilege escalation of configuration control.

Attack Vector

An attacker registers or uses an existing Subscriber account on a target WordPress site that has installed but not yet configured the Call Now Button plugin. The attacker issues an authenticated request to the plugin's activation endpoint, supplying an API key tied to a nowbuttons.com account under their control. The plugin accepts the request, persists the API key, and begins pulling button configurations from the attacker's account. Visitors then see malicious buttons that can redirect to phishing pages, dialers, or tel: links used for toll fraud. Technical details are documented in the WordPress Plugin Code Review and CleanTalk CVE-2025-11587 Analysis.

No verified exploit code is published. See the linked plugin source and analysis for endpoint details.

Detection Methods for CVE-2025-11587

Indicators of Compromise

• Unexpected nowbuttons.com API key stored in the plugin options when no administrator performed the linking
• New or modified click-to-call buttons appearing on the front end with unfamiliar phone numbers or URLs
• Authenticated requests to the plugin's activation endpoint originating from Subscriber-level accounts
• Outbound HTTP traffic from the WordPress host to nowbuttons.com endpoints without an administrator initiating setup

Detection Strategies

• Audit the wp_options table for Call Now Button configuration entries and confirm the stored API key matches the account owned by the site administrator
• Review WordPress access logs for POST requests to the plugin's admin-ajax.php or REST activation route made by non-administrator users
• Compare rendered button markup on the live site against the approved configuration to identify silent replacements

Monitoring Recommendations

• Alert on privilege-sensitive plugin option writes performed by users below the Administrator role
• Monitor creation of new Subscriber accounts followed by requests to plugin management endpoints within a short window
• Track outbound connections from the web tier to third-party button-management services and validate they align with configured integrations

How to Mitigate CVE-2025-11587

Immediate Actions Required

• Update the Call Now Button plugin to a version later than 1.5.3 once released by the vendor
• On unconfigured installations, complete the legitimate API key linking immediately to close the exploitation window
• Audit existing plugin configuration and remove any API key or button entries that were not provisioned by an administrator
• Restrict user registration or the default new-user role if Subscriber accounts are not required for site functionality

Patch Information

Refer to the Wordfence Vulnerability Report for the current patched version and vendor advisory status. The remediation adds a capability check to the activation handler in class-ott-controller.php so that only users with administrative privileges can link the plugin to a nowbuttons.com account.

Workarounds

• Deactivate the Call Now Button plugin on sites that have not yet linked an API key until a patched version is installed
• Disable open user registration via Settings → General → Membership to prevent attackers from obtaining Subscriber accounts
• Use a web application firewall rule to block non-administrator requests to the plugin's activation endpoint

# Disable open registration and enforce lowest-privilege default role
wp option update users_can_register 0
wp option update default_role subscriber

# Deactivate the vulnerable plugin until patched
wp plugin deactivate call-now-button