CVE-2026-14309

Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.

Affected

Chat On Desk Order Notifications

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.38% chance of exploitation in the next 30 days, 31st percentile

Published

2026-08-01

Updated

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/82f14006-c05f-421d-9ba5-bc745e0b2ab8/

References

• CVE Record
• NVD entry