CVE-2025-24738 Overview
CVE-2025-24738 is a Cross-Site Request Forgery (CSRF) vulnerability in the Jerry Rietveld Call Now Button plugin for WordPress. The flaw affects all versions of call-now-button up to and including 1.4.13. An attacker can craft a malicious request that, when triggered by an authenticated user, performs unintended state-changing actions in the plugin without the user's consent.
The issue is tracked under CWE-352 (Cross-Site Request Forgery). Successful exploitation requires user interaction, such as clicking a crafted link or visiting an attacker-controlled page while authenticated to the WordPress site.
Critical Impact
An authenticated administrator visiting an attacker-controlled page can be forced to submit unintended requests to the Call Now Button plugin, resulting in low-impact availability effects on plugin configuration or state.
Affected Products
- Jerry Rietveld Call Now Button plugin (call-now-button) for WordPress
- All versions from initial release through 1.4.13
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2025-01-24 - CVE-2025-24738 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24738
Vulnerability Analysis
The Call Now Button plugin exposes one or more state-changing endpoints that do not validate a CSRF token (nonce) before processing incoming requests. WordPress plugins typically use the wp_nonce_field() and check_admin_referer() functions to bind privileged actions to an authenticated session. When these checks are absent or improperly implemented, the browser's ambient authority — cookies sent automatically with every request — is sufficient to execute the action on behalf of a logged-in user.
Exploitation requires user interaction. An attacker crafts an HTML page or link that submits a forged request to the vulnerable plugin endpoint. If a WordPress administrator visits the page while authenticated, the browser sends the session cookies alongside the malicious request. The Exploit Prediction Scoring System (EPSS) probability for this CVE is 0.214%, indicating a low likelihood of active exploitation.
Root Cause
The root cause is missing or improperly verified anti-CSRF tokens on plugin request handlers up to version 1.4.13. Requests that alter plugin configuration or state are accepted based solely on the presence of a valid authenticated session, without confirming intent through a nonce parameter.
Attack Vector
The attack vector is network-based and requires the victim to interact with attacker-controlled content. The typical delivery method is a phishing link, a malicious advertisement, or an embedded resource on a third-party site. The impact is limited to availability effects on the plugin's functionality on the affected WordPress site.
No public proof-of-concept exploit code has been published for this CVE. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-24738
Indicators of Compromise
- Unexpected changes to Call Now Button plugin settings without corresponding administrator activity in audit logs
- HTTP POST requests to plugin endpoints with Referer headers pointing to external, unrelated domains
- Requests to plugin admin URLs missing a valid _wpnonce parameter
Detection Strategies
- Monitor WordPress access logs for state-changing requests to call-now-button plugin paths originating from cross-origin referers
- Correlate administrator session activity with plugin configuration changes to identify actions the user did not initiate
- Deploy a Web Application Firewall (WAF) rule that inspects requests to plugin endpoints for missing or invalid nonce parameters
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all administrator-level configuration changes with timestamps and source IPs
- Alert on outbound requests from administrator browsers to unfamiliar domains that may host CSRF payloads
- Review plugin activity logs regularly for anomalous modification patterns tied to authenticated sessions
How to Mitigate CVE-2025-24738
Immediate Actions Required
- Update the Call Now Button plugin to a version released after 1.4.13 that includes the CSRF fix
- If no fixed version is available, deactivate and remove the plugin until a patch is published by the maintainer
- Instruct WordPress administrators to log out of the admin panel when not actively managing the site
Patch Information
Consult the Patchstack Vulnerability Report for the latest patch status and fixed release information. Apply plugin updates through the WordPress admin dashboard or via wp-cli as soon as a patched version is available.
Workarounds
- Restrict access to the WordPress admin interface by IP allowlist at the web server or WAF layer
- Enforce SameSite=Strict or SameSite=Lax on WordPress session cookies to reduce cross-site request delivery
- Require administrators to use a dedicated browser or browser profile for WordPress management to isolate cookies from general browsing
# Update the Call Now Button plugin using wp-cli
wp plugin update call-now-button
# If no fixed version is available, deactivate and remove the plugin
wp plugin deactivate call-now-button
wp plugin delete call-now-button
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
