Call Now Button WordPress Plugin Missing Authorization Vulnerability on Fresh Installs

A vulnerability exists in the Call Now Button WordPress plugin, specifically in versions through 1.5.3. The issue arises from a missing capability check in the activate function, allowing authenticated attackers with Subscriber-level access and above to manipulate plugin data. Exploitation involves linking the plugin to a nowbuttons.com account and adding malicious buttons to the site. This vulnerability is only applicable to new installations of the plugin that have not yet been configured with an API key.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin data, including the addition of malicious buttons on the site.

Remediation

Users are advised to update the Call Now Button WordPress plugin to version 1.5.4 or a newer patched version.