What is the CVSS score of CVE-2026-14309?

CVE-2026-14309 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chat On Desk are affected by CVE-2026-14309?

The Chat On Desk Order Notifications WordPress plugin (pre-1.0.9) contains an unauthenticated authentication bypass enabling complete account takeover, including administrator accounts.. A patch is available.

Is there a public PoC exploit available for CVE-2026-14309?

Yes, a public proof-of-concept exploit is available for CVE-2026-14309. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14309?

Within 24 hours: verify if this plugin is installed and determine whether SMS one-time-password reset is enabled; if not operationally required, disable this feature immediately. Within 7 days: update the plugin to version 1.0.9 or later from the official WordPress repository and review access logs from the past 30 days for unauthorized password resets or unexpected administrative account modifications. Within 30 days: audit all user accounts with administrative privileges to confirm their legitimacy, and implement additional authentication controls such as IP-based access restrictions or hardware security keys to supplement password-based security.

Chat On Desk CVE-2026-14309

EUVD-2026-51721 HIGH

Improper Authentication (CWE-287)

2026-08-01 WPScan

GHSA-ggm5-8542-75h6

WordPress Authentication Bypass Chat On Desk Order Notifications Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AC:H reflects the non-trivial multi-step API manipulation required to bypass OTP; full C/I/A impact follows from unrestricted admin account takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:37 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

8.1 (None) 8.1 (HIGH)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.

AnalysisAI

Password reset authentication bypass in the Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9) allows unauthenticated remote attackers to take over arbitrary user accounts, including administrators, by submitting a new password without completing OTP verification. Exploitation is conditional on the SMS one-time-password reset feature being active on the target site. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC rates exploitation status as 'none,' suggesting currently limited attacker uptake despite disclosed exploit code. No confirmed active exploitation (CISA KEV) at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-287 (Improper Authentication) - specifically a broken authentication flow in the plugin's SMS-based password reset feature. In a properly implemented OTP flow, the server must validate that the user-submitted one-time password is correct and mark the session as verified before accepting a new password. This plugin skips that verification step, accepting the password-reset submission regardless of OTP validation state. The affected component is the 'Chat On Desk Order Notifications' WordPress plugin, identified by CPE cpe:2.3:a:unknown:chat_on_desk_order_notifications:*:*:*:*:*:*:*:*, all versions prior to 1.0.9. The flaw is a server-side business logic error, not a client-side or cryptographic weakness.

RemediationAI

Update the Chat On Desk Order Notifications plugin to version 1.0.9 or later, which introduces proper OTP validation before accepting password-reset requests, per the vendor patch referenced in the WPScan advisory (https://wpscan.com/vulnerability/82f14006-c05f-421d-9ba5-bc745e0b2ab8/). If an immediate upgrade is not feasible, disable the SMS one-time-password password reset feature within the plugin's settings - this eliminates the vulnerable code path entirely, as exploitation is only possible when this feature is active. Note that disabling SMS OTP reset will force users to rely on alternative password recovery methods, which may require WordPress's native email-based reset to be functional. No other workarounds have been identified in available data.