CVE-2026-14309

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.23% chance of exploitation in the next 30 days, 13th percentile

Published

2026-08-01

Updated

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/82f14006-c05f-421d-9ba5-bc745e0b2ab8/

References

• CVE Record
• NVD entry

Related

• CVE-2026-14307
• CVE-2026-14310
• CVE-2026-14306
• CVE-2026-14313
• CVE-2026-14305
• CVE-2026-14314