Chat On Desk Order Notifications
Monthly
Password reset authentication bypass in the Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9) allows unauthenticated remote attackers to take over arbitrary user accounts, including administrators, by submitting a new password without completing OTP verification. Exploitation is conditional on the SMS one-time-password reset feature being active on the target site. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC rates exploitation status as 'none,' suggesting currently limited attacker uptake despite disclosed exploit code. No confirmed active exploitation (CISA KEV) at time of analysis.
Password reset authentication bypass in the Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9) allows unauthenticated remote attackers to take over arbitrary user accounts, including administrators, by submitting a new password without completing OTP verification. Exploitation is conditional on the SMS one-time-password reset feature being active on the target site. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC rates exploitation status as 'none,' suggesting currently limited attacker uptake despite disclosed exploit code. No confirmed active exploitation (CISA KEV) at time of analysis.