CVE-2025-14270

The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled phone numbers.

• CWE-862

• https://cwe.mitre.org/data/definitions/862.html
• https://developer.wordpress.org/plugins/security/checking-user-capabilities/
• https://developer.wordpress.org/plugins/security/nonces/
• https://plugins.trac.wordpress.org/browser/oneclick-whatsapp-order/tags/1.0.9/includes/multiple-numbers.php#L156
• https://plugins.trac.wordpress.org/browser/oneclick-whatsapp-order/tags/1.0.9/includes/multiple-numbers.php#L26
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417664%40oneclick-whatsapp-order&new=3417664%40oneclick-whatsapp-order&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b5cc5e-af82-49e0-a0b5-d27c3631a102?source=cve

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14262A wrong permission check in KNIME Business Hub before versio…4.3
• CVE-2025-14265In versions of ScreenConnect™ prior to 25.8, server-side val…9.1
• CVE-2025-14266CSRF in Ercom Cryptobox administration console allows attack…0.6
• CVE-2025-14267Incomplete removal of sensitive information before transfer …4.9
• CVE-2025-14268Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-1427A maliciously crafted CATPRODUCT file, when parsed through A…7.8
• CVE-2025-14271Rejected reason: This CVE ID has been withdrawn by its CVE N…
• CVE-2025-14272A security issue was identified in Pavilion due to improper …8.3
• CVE-2025-14273Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.1…8.3
• CVE-2025-14274The Unlimited Elements for Elementor plugin for WordPress is…5.4
• CVE-2025-14275The Jeg Elementor Kit plugin for WordPress is vulnerable to …6.4
• CVE-2025-14276A vulnerability was determined in Ilevia EVE X1 Server up to…5.6