Call Now Button CVE-2025-11587

Exploitation requires an authenticated account with Subscriber-level privileges or above (CVSS PR:L), and is explicitly limited to fresh installations of Call Now Button where the plugin has NOT previously been configured with a nowbuttons.com API key - on already-configured sites the activate path is not abusable. The specific weakness is a missing capability check on the plugin's activate function (class-ott-controller.php), allowing the low-privilege user to bind the site to an attacker-controlled nowbuttons.com account and inject buttons. Key limiting factors: an attacker must already have (or be able to self-register) a valid low-privilege account, and the install must be in the unconfigured default state; no higher privileges or admin access are needed, and no user interaction is required (UI:N).

This is a genuinely low-to-moderate priority issue despite being a 'vulnerability,' and the signals are largely consistent. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but requiring authenticated Subscriber-level access (PR:L) and yielding only limited integrity impact (I:L) with no confidentiality or availability impact. EPSS reinforces this as low urgency at 0.23% (13th percentile), indicating a very low modeled probability of exploitation in the near term. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is 'no public exploit identified at time of analysis.' A critical mitigating factor stated in the description constrains real risk further: exploitation is only possible on fresh installs where the plugin has not yet been configured with an API key, which sharply narrows the realistic attack surface. No SSVC decision data was provided in the input. Overall the signals do not conflict - a missing capability check (CWE-862) exploitable only by an already-authenticated low-privilege user against unconfigured installs, with low EPSS and no known exploitation, points to a low real-world priority rather than an emergency.

An attacker who holds or registers a low-privilege Subscriber account on a WordPress site running Call Now Button (<=1.5.3) that has never been configured with an API key sends a request to the unprotected activate function. This links the site's plugin to the attacker's nowbuttons.com account, letting them inject malicious click-to-call buttons visible to site visitors. No public proof-of-concept is identified in the provided data.