# OneClick Chat to Order <= 1.1.2 - Unauthenticated Sensitive Information Exposure via Thank You Page WhatsApp Button

- **ID:** WPSEC-2026-2232
- **Plugin:** OneClick Chat to Order (`oneclick-whatsapp-order`), https://wordpress.org/plugins/oneclick-whatsapp-order/
- **Affected versions:** all versions before 1.2.0
- **Fixed in:** 1.2.0 (Update to 1.2.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-359
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/oneclick-whatsapp-order
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2232/

## Description

The OneClick Chat to Order plugin for WordPress is vulnerable to Sensitive Information Exposure via the thank you (order received) page WhatsApp button in all versions up to, and including, 1.1.2. The plugin builds the button's prefilled message from the order's customer details even when WooCommerce does not show the order to the current visitor, such as a logged-out customer or a guest who still has to confirm their email. This makes it possible for unauthenticated attackers who obtain an order received URL to read the customer's name, address, email address and phone number from the button. Exploitation requires the thank you page button to be enabled and access to a valid order received link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2232/
- https://plugins.svn.wordpress.org/oneclick-whatsapp-order/tags/1.2.0/
- https://wordpress.org/plugins/oneclick-whatsapp-order/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2232/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.