The Call Now Button – The #1 Click to Call Button for WordPress plugin contains a missing capability check in its activate function for all versions up to 1.5.3. This flaw allows an attacker who has authenticated access with Subscriber-level permissions or higher to activate the plugin and link it to an attacker‑controlled nowbuttons.com account. Once linked, the attacker can add malicious buttons to the site. The vulnerability only applies to fresh installs where the plugin has not yet been configured with an API key, so already configured sites are not affected at the time of discovery.

The affected plugin is the WordPress plugin Call Now Button – The #1 Click to Call Button for WordPress, versions 1.5.3 and earlier. No other vendors or products are cited.

The CVSS score of 4.3 classifies this as a moderate impact. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated with at least Subscriber permissions, implying exploitation from a valid user account on the target site. Since the flaw only triggers on fresh installations, the attack surface is limited to newly‑installed, unconfigured instances of the plugin.