Vulnerabilities and security researches forchat-on-desk chat-on-desk

Aug 04, 2026

CVE, Research URL: CVE-2026-14309
Home page URL: Security reports for Chat On Desk Order Notifications – WooCommerce
Application: Chat On Desk Order Notifications – WooCommerce
Date: Aug 01, 2026
Research Description: The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.
Affected versions: max 1.0.9.
Status: vulnerable