CVE-2025-13526: OneClick Chat WordPress IDOR Vulnerability

CVE-2025-13526 Overview

The OneClick Chat to Order plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.0.8. The vulnerability exists in the wa_order_thank_you_override function, which fails to validate user-controlled input before returning sensitive order information. This allows unauthenticated attackers to access customer data by manipulating order ID parameters in the URL.

Critical Impact
Unauthenticated attackers can view sensitive customer information including names, email addresses, phone numbers, billing/shipping addresses, order contents, and payment methods by simply changing the order ID in the URL.

Affected Products

OneClick Chat to Order WordPress Plugin version 1.0.8 and earlier
WordPress installations using vulnerable plugin versions
E-commerce sites utilizing the OneClick WhatsApp Order functionality

Discovery Timeline

2025-11-22 - CVE-2025-13526 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13526

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from the wa_order_thank_you_override function within the plugin's thank-you page handler, which processes order IDs directly from user input without implementing proper authorization checks.

When a customer completes an order, the plugin generates a thank-you page with the order details. The vulnerability allows any user—authenticated or not—to access order information belonging to other customers by simply modifying the order ID parameter in the request URL. This represents a classic Insecure Direct Object Reference pattern where the application trusts user-supplied identifiers without verifying ownership or access permissions.

The attack requires no special privileges or user interaction, making it trivially exploitable over the network. While the vulnerability is limited to information disclosure (confidentiality impact), the nature of the exposed data—including personally identifiable information, payment methods, and complete order histories—makes this a significant privacy and compliance concern for affected e-commerce sites.

Root Cause

The root cause lies in the missing validation of user-controlled keys within the wa_order_thank_you_override function. The vulnerable code located at line 126 of wa-order-thank-you.php accepts an order ID parameter without verifying that the requesting user has legitimate access to view that order's information. The function fails to implement proper authorization controls such as checking order ownership, user session validation, or capability verification before returning sensitive order data.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. An unauthenticated attacker can enumerate order IDs sequentially or predictively to harvest customer data from vulnerable WordPress installations. The attack requires no user interaction and can be automated to extract large volumes of sensitive customer information.

The attacker simply needs to:

Navigate to a legitimate order thank-you page URL
Modify the order ID parameter in the URL to a different value
Access order details belonging to other customers without any authentication

This type of horizontal privilege escalation through IDOR vulnerabilities is particularly dangerous in e-commerce contexts where customer PII and payment information are at stake.

Detection Methods for CVE-2025-13526

Indicators of Compromise

Unusual access patterns to the thank-you page endpoint with sequential or randomized order IDs
Multiple requests from single IP addresses to /wp-content/plugins/oneclick-whatsapp-order/ paths with varying order parameters
Access logs showing unauthenticated requests to order confirmation pages that should require authentication
High-volume enumeration attempts targeting the wa_order_thank_you_override function

Detection Strategies

Monitor web server access logs for unusual patterns of requests to the plugin's thank-you page endpoint with varying order ID parameters
Implement rate limiting on order detail endpoints to detect and block enumeration attempts
Configure web application firewall (WAF) rules to alert on sequential parameter manipulation patterns
Review audit logs for access to order data from IP addresses not associated with the original customer

Monitoring Recommendations

Enable detailed access logging for WordPress plugin directories and order-related endpoints
Set up alerts for high-frequency access to order confirmation URLs from single sources
Monitor for data exfiltration patterns indicating bulk customer information harvesting
Implement anomaly detection for unusual access patterns to customer order data

How to Mitigate CVE-2025-13526

Immediate Actions Required

Update the OneClick Chat to Order plugin to a patched version immediately
Review access logs to determine if the vulnerability has been exploited
Notify affected customers if evidence of data exposure is discovered
Consider temporarily disabling the plugin until the patch is applied

Patch Information

A security update addressing this vulnerability is available. The fix was committed in WordPress Changeset 3391625, which adds proper authorization validation to the wa_order_thank_you_override function. Site administrators should update to the latest version of the plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

For detailed technical analysis of the vulnerability, refer to the Wordfence Vulnerability Analysis. The vulnerable source code can be examined at the WordPress Plugin Source Code repository.

Workarounds

Implement WAF rules to restrict access to the thank-you page endpoint to authenticated users only
Add server-level access controls requiring authentication for order-related plugin endpoints
Temporarily disable the OneClick Chat to Order plugin until an update can be applied
Consider implementing additional nonce verification at the server level for order detail requests

bash

# Example .htaccess rules to restrict access to vulnerable endpoint
<Files "wa-order-thank-you.php">
    Order Deny,Allow
    Deny from all
    # Allow only authenticated WordPress admin access
    Allow from 127.0.0.1
</Files>