OneClick Chat to Order <= 1.1.2 - Unauthenticated Sensitive Information Exposure via Thank You Page WhatsApp Button
- ID
- WPSEC-2026-2232
- Plugin
- OneClick Chat to Order (oneclick-whatsapp-order)
- Affected
- all versions before 1.2.0
- Remediation
- Update to 1.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-359
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- OneClick Chat to Order on WPSec AttackSurface
- Fix released
- Published
Description
The OneClick Chat to Order plugin for WordPress is vulnerable to Sensitive Information Exposure via the thank you (order received) page WhatsApp button in all versions up to, and including, 1.1.2. The plugin builds the button's prefilled message from the order's customer details even when WooCommerce does not show the order to the current visitor, such as a logged-out customer or a guest who still has to confirm their email. This makes it possible for unauthenticated attackers who obtain an order received URL to read the customer's name, address, email address and phone number from the button. Exploitation requires the thank you page button to be enabled and access to a valid order received link.
References
- https://wpsec.com/vuln/WPSEC-2026-2232/
- https://plugins.svn.wordpress.org/oneclick-whatsapp-order/tags/1.2.0/
- https://wordpress.org/plugins/oneclick-whatsapp-order/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS