What the vulnerability does
01Description
The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.
Explanation of Vulnerability in Simple Terms
02Summary
OneClick Chat to Order versions 1.0.9 and earlier lack proper authorization checks on certain administrative functions. A high-privileged user can modify data they should not have access to. The vulnerability requires an authenticated admin account and has low integrity impact. Update to a version newer than 1.0.9.
What an attacker can do
03Attacker Capabilities
Modify data without proper authorization checks if they have admin privileges.
Potential impact on your site
04Site Impact
Admin users with restricted roles may be able to modify settings or data beyond their intended permissions.
Conditions required to exploit
05Prerequisites
Attacker must have high-level admin account access to the application.
Key dates
06Disclosure timeline
February 19, 2026
CVE published
April 8, 2026
Record updated
