Security Advisory

CVE-2026-14309

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-01 06:00:08

Last updated 2026-08-01 06:00:08

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.

← Browse all CVEs View on cve.org ↗