{"id":"CVE-2025-14270","aliases":["EUVD-2025-207559","GHSA-rww7-gq38-qv2c"],"status":"published","title":"OneClick Chat to Order \u003c= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update","description":"The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00354,"percentile":0.29561,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-02-19T04:36:21Z","modified":"2026-06-17T08:35:38Z","products":[{"vendor":"walterpinem","product":"oneclick chat to order"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b5cc5e-af82-49e0-a0b5-d27c3631a102?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/oneclick-whatsapp-order/tags/1.0.9/includes/multiple-numbers.php#L156"},{"url":"https://plugins.trac.wordpress.org/browser/oneclick-whatsapp-order/tags/1.0.9/includes/multiple-numbers.php#L26"},{"url":"https://developer.wordpress.org/plugins/security/checking-user-capabilities/"},{"url":"https://developer.wordpress.org/plugins/security/nonces/"},{"url":"https://cwe.mitre.org/data/definitions/862.html"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3417664%40oneclick-whatsapp-order\u0026new=3417664%40oneclick-whatsapp-order\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14270"},{"url":"https://developer.wordpress.org/plugins/security/checking-user-capabilities"},{"url":"https://developer.wordpress.org/plugins/security/nonces"},{"url":"https://github.com/advisories/GHSA-rww7-gq38-qv2c"}],"sources":{"cve":[{"id":"CVE-2025-14270","title":"OneClick Chat to Order \u003c= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update","description":"The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.","status":"published","published":"2026-02-19T04:36:21.072Z","modified":"2026-04-08T17:17:02.176Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2025-207559","description":"The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.","status":"published","published":"2026-02-19T04:36:21Z","modified":"2026-04-08T17:17:02Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:24:44.170067Z"}],"ghsa":[{"id":"GHSA-rww7-gq38-qv2c","title":"The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions...","description":"The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.","status":"published","published":"2026-02-19T18:31:49Z","modified":"2026-02-19T18:32:03Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:06:16.865747Z"}],"nvd":[{"id":"CVE-2025-14270","description":"The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.","status":"published","published":"2026-02-19T07:17:34.523Z","modified":"2026-06-17T08:35:38.91Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:00.273026Z"}]}}