Call Now Button CVE-2025-11632
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Subscriber-level user
-
ExploitInvoke unprotected admin AJAX function
-
ExecutionGenerate billing portal link / session token
-
ImpactView and modify account billing data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account at Subscriber level or above (PR:L) on a WordPress site running Call Now Button version 1.5.4 or earlier; the vulnerable admin AJAX functions in src/admin/CnbAdminAjax.php and src/admin/chat/class-cnb-chat-controller.php omit capability checks, so any logged-in low-privilege user can call them. The practical limiting factor is obtaining that Subscriber account - exposure is materially higher on sites that permit open user registration and lower on sites restricted to trusted authors/admins. No special plugin configuration is needed beyond having the plugin installed and connected to a Call Now Button billing/account. Patched in 1.5.5 (only partially in 1.5.4). |
| Impact | This is a broken-access-control (CWE-862 Missing Authorization) flaw in the Call Now Button WordPress plugin, and the signals consistently point to moderate-to-low real-world urgency rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated Subscriber-level account, which is the key limiting factor. EPSS is low at 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit has been identified - so this is not confirmed to be actively exploited and should be treated as a patch-in-normal-cycle item, weighted up where anonymous user registration is enabled. One notable conflict: NVD scored integrity as I:N, yet the description explicitly states authenticated attackers can 'view and modify billing information' and generate chat session tokens, which implies a genuine integrity impact - the official vector appears to understate integrity and should be verified against the Wordfence advisory. There is no sign of cross-privilege escalation (S:U), so impact is confined to the billing/account data exposed by the vulnerable AJAX functions. |
| Exploit ScenarioDerived | On a WordPress site that allows user self-registration (or where any low-privileged account exists), an attacker registers or logs in as a Subscriber and directly invokes the plugin's unprotected admin AJAX endpoints in CnbAdminAjax.php. Because those functions never check the caller's capability, the Subscriber can mint links to the billing portal and view or alter the connected account's billing information, generate chat session tokens, and read domain status. No public exploit code or active exploitation has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Broken access control in the Call Now Button WordPress plugin (all versions up to and including 1.5.4) lets any authenticated user with Subscriber-level access or higher call several administrative AJAX handlers that omit capability checks, exposing links to the site owner's connected billing portal, chat session tokens, and domain status information, and - per the vendor description - permitting modification of billing details. The issue was only partially fixed in 1.5.4 and fully fixed in 1.5.5; no public exploit code was identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.27% (18th percentile), so real-world urgency is moderate-to-low rather than an emergency, with exposure rising sharply on sites that allow open user registration. Authentication requirements are confirmed as low-privileged but authenticated (CVSS vector PR:L), so an attacker must first obtain a valid subscriber account on the target site.
RemediationAI
The primary fix is to update the Call Now Button plugin to version 1.5.5, which the vendor describes as the fully patched release; upgrading only to 1.5.4 is insufficient because the vendor confirms that version contains only a partial fix. If an immediate upgrade is not possible, compensating controls should target the attacker prerequisite rather than the code: since exploitation requires a valid Subscriber-or-higher account, disable open user registration and new-user default roles (Settings > General and any membership plugin), and audit and remove unused low-privilege accounts - the trade-off is that legitimate self-service signups and commenter-driven registrations must be handled manually. Sites that do not need the click-to-call widget can deactivate and delete the plugin, which fully removes the attack surface at the cost of the call-button functionality; sites that need it should at minimum disconnect the plugin from the vendor billing/chat account while unpatched, since the exposed handlers relate to that external account. Because the vulnerable entry points are admin-ajax.php actions, defenders can also monitor or temporarily block requests to admin-ajax.php carrying the affected action parameters, though broad admin-ajax.php blocking will break other plugins and is not viable as a long-term measure. Remediation guidance and the affected-function detail are published in the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/379547a2-6b22-4ec9-8570-a043dda7ec09?source=cve, with the vulnerable source visible in the 1.5.3 Trac snapshot referenced above. The CVSS vector confirms PR:L, so restricting account creation is the single most effective interim control.
Affected ProductsAI
The affected product is the Call Now Button - The #1 Click to Call Button for WordPress plugin (WordPress slug call-now-button), in all versions up to and including 1.5.4; the vendor states the fix was partial in 1.5.4 and complete in 1.5.5, so 1.5.4 should be treated as still vulnerable to at least part of the exposed functionality. The vulnerable code paths are in src/admin/CnbAdminAjax.php and src/admin/chat/class-cnb-chat-controller.php, with the 1.5.3 tag used as the reference snapshot in the plugins.trac.wordpress.org links (lines 21, 50, 147, 154, 167 and class-cnb-chat-controller.php line 52). No CPE identifiers were provided in the source data. The primary advisory is the Wordfence Threat Intel entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/379547a2-6b22-4ec9-8570-a043dda7ec09?source=cve, and the code references are the Trac links under https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/. Any WordPress installation running 1.5.4 or earlier where the plugin is installed and connected to a Call Now Button account is in scope.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-862 Missing Authorization flaw in a WordPress plugin. WordPress exposes plugin AJAX endpoints through admin-ajax.php (and the REST API), and the standard defense is a capability check such as current_user_can() combined with a nonce check. In Call Now Button 1.5.4 and earlier, multiple handlers in src/admin/CnbAdminAjax.php (referenced at lines 21, 50, 147, 154 and 167 in the 1.5.3 tag) and in src/admin/chat/class-cnb-chat-controller.php (line 52) perform their work without verifying that the caller holds an administrative capability, so any logged-in account - including the default Subscriber role - can invoke them. Because the plugin bridges the WordPress site to the vendor's Call Now Button SaaS account, those handlers mint links to the external billing portal, generate chat session tokens, and report domain status, meaning the missing check leaks and potentially mutates data that lives outside WordPress proper. No CPE strings were supplied in the input, so the affected product should be tracked as the WordPress plugin slug call-now-button rather than as an operating-system or platform component; the corresponding CWE-862 classification is the authoritative root-cause label.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Subscriber account required so PR:L; description states billing data can be both viewed and modified, so I:L is added over NVD's I:N while C:L and A:N are retained.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The Call Now Button - The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate links to billing portal, where they can view and modify billing information of the connected, account, generate chat session tokens, view domain status, etc. This vulnerability was partially fixed in version 1.5.4 and fully fixed in version 1.5.5
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
GitHub PoC
Exploit-DB