PT-2025-47835 · WordPress · Oneclick Chat To Order

Published 2025-11-22 · Updated 2025-11-29 · CVE-2025-13526

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OneClick Chat to Order plugin for WordPress versions up to and including 1.0.8

Description The OneClick Chat to Order plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of validation on a user-controlled key within the wa order thank you override function. An unauthenticated attacker can potentially view sensitive customer information, including names, email addresses, phone numbers, billing and shipping addresses, order contents, and payment methods, by modifying the order ID in the URL.

Recommendations Versions prior to 1.0.8 should be updated. As a temporary workaround, restrict access to the wa order thank you override function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13526

Affected Products

Oneclick Chat To Order

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-13526 · Security Note
• https://t.me/cveNotify/143690 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/547a0c73-044e-49ba-9bec-4f80b41b8ea2?source=cve · Note
• https://twitter.com/pentesttesting/status/1994698084274901310 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3391625 · Note
• https://twitter.com/VulmonFeeds/status/1992193014056280321 · Twitter Post
• https://twitter.com/cracbot/status/1993998281421279636 · Twitter Post
• https://t.me/CVEtracker/38004 · Telegram Post
• https://twitter.com/RedPacketSec/status/1992255371801465338 · Twitter Post
• https://plugins.trac.wordpress.org/browser/oneclick-whatsapp-order/trunk/includes/buttons/wa-order-thank-you.php#L126 · Note
• https://twitter.com/CVEnew/status/1992192850952671631 · Twitter Post