What the vulnerability does
01Description
The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order_thank_you_override' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view sensitive customer information including names, email addresses, phone numbers, billing/shipping addresses, order contents, and payment methods by simply changing the order ID in the URL.
Explanation of Vulnerability in Simple Terms
02Summary
OneClick Chat to Order versions 1.0.8 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve this data directly without needing to log in or interact with a user. The vulnerability affects the product's core functionality and may expose customer or business data depending on what information the application stores.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the application without logging in.
Potential impact on your site
04Site Impact
Customer data, business information, or other sensitive details stored in the application may be publicly readable.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 22, 2025
CVE published
April 8, 2026
Record updated
