The Call Now Button plugin for WordPress contains a missing capability check identified as CWE‑862, allowing an authenticated user with a Subscriber role or higher to bypass authorization. This flaw permits the attacker to generate links to the billing portal, view and modify billing information, export chat session tokens, and inspect domain status. The possibility to alter financial data and the exposure of sensitive account details elevate the confidentiality and integrity risks associated with this vulnerability.

All releases of the Call Now Button – The #1 Click to Call Button for WordPress plugin up to and including version 1.5.4 are affected. The plugin runs within a WordPress site and any logged‑in user who holds a Subscriber or higher capability can potentially exercise the unauthorized functions exposed by the missing checks.

The CVSS score of 4.3 classifies the issue as moderate severity, while the EPSS score of < 1 % indicates a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active attacks yet. The likely attack vector involves an authenticated user crafting requests to the plugin’s administrative AJAX endpoints to trigger the privileged actions, inference based on the provided code references.