A cross‑site request forgery weakness exists in the WordPress Call Now Button plugin, classified as CWE‑352. The flaw permits an attacker to cause a logged‑in user to send a request to the plugin’s endpoints without the user’s explicit consent. Based on the description, it is inferred that the attacker could potentially modify or submit data through the plugin, thereby compromising the integrity of the site’s content or configuration.

The vulnerability affects all releases of the Jerry Rietveld Call Now Button plugin up to and including version 1.4.13. Any WordPress installation that has installed the plugin at any earlier version is therefore susceptible; no other products or later versions are listed as impacted.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% signifies a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog. Exploitation would normally require an authenticated user to visit a maliciously crafted URL that targets a vulnerable endpoint within the plugin. Therefore, the risk is limited to sites where such a request can be delivered to a legitimate user session.