Insecure Direct Object Reference Vulnerability in OneClick Chat to Order Plugin for WordPress

CVE-2025-13526

What is CVE-2025-13526?

The OneClick Chat to Order plugin for WordPress is susceptible to an Insecure Direct Object Reference, allowing unauthenticated attackers to access sensitive customer data through the 'wa_order_thank_you_override' function. By simply altering the order ID in the URL, attackers can expose private information such as names, email addresses, phone numbers, billing and shipping addresses, as well as order contents and payment methods. This vulnerability underscores the need for stringent access controls and proper validation methods to safeguard user data.

References