Unverified Password Reset in Chat On Desk Order Notifications Plugin for WordPress
CVE-2026-14309
Currently unrated
What is CVE-2026-14309?
The Chat On Desk Order Notifications plugin for WordPress, specifically versions prior to 1.0.9, contains a vulnerability that fails to adequately verify one-time passwords before processing password reset requests. This oversight allows unauthorized individuals to exploit the system and reset the passwords of any user, including admin accounts, particularly when the SMS-based password reset feature is enabled. The lack of proper validation poses significant risks to the security of user accounts and personal data.
Affected Version(s)
Chat On Desk Order Notifications 0 < 1.0.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.