{
 "id": "WPSEC-2026-2232",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2232/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2232/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2232/index.md",
 "title": "OneClick Chat to Order <= 1.1.2 - Unauthenticated Sensitive Information Exposure via Thank You Page WhatsApp Button",
 "description": "The OneClick Chat to Order plugin for WordPress is vulnerable to Sensitive Information Exposure via the thank you (order received) page WhatsApp button in all versions up to, and including, 1.1.2. The plugin builds the button's prefilled message from the order's customer details even when WooCommerce does not show the order to the current visitor, such as a logged-out customer or a guest who still has to confirm their email. This makes it possible for unauthenticated attackers who obtain an order received URL to read the customer's name, address, email address and phone number from the button. Exploitation requires the thank you page button to be enabled and access to a valid order received link.",
 "plugin": {
  "slug": "oneclick-whatsapp-order",
  "name": "OneClick Chat to Order",
  "full_name": "OneClick Chat to Order",
  "wordpress_org": "https://wordpress.org/plugins/oneclick-whatsapp-order/",
  "advisories_url": "https://wpsec.com/vuln/plugin/oneclick-whatsapp-order/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/oneclick-whatsapp-order"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-359"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.2.0",
 "remediation": "Update to 1.2.0 or later.",
 "fix_released": "2026-11-02T08:03:48+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:43.827363+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2232/",
  "https://plugins.svn.wordpress.org/oneclick-whatsapp-order/tags/1.2.0/",
  "https://wordpress.org/plugins/oneclick-whatsapp-order/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/oneclick-whatsapp-order",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}