CVE-2025-13526: OneClick Chat WordPress IDOR Vulnerability

CVE-2025-13526 Overview

The OneClick Chat to Order plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.0.8. The vulnerability exists in the wa_order_thank_you_override function, which fails to validate user-controlled input before returning sensitive order information. This allows unauthenticated attackers to access customer data by manipulating order ID parameters in the URL.

Critical Impact

Unauthenticated attackers can view sensitive customer information including names, email addresses, phone numbers, billing/shipping addresses, order contents, and payment methods by simply changing the order ID in the URL.

Affected Products

• OneClick Chat to Order WordPress Plugin version 1.0.8 and earlier
• WordPress installations using vulnerable plugin versions
• E-commerce sites utilizing the OneClick WhatsApp Order functionality

Discovery Timeline

• 2025-11-22 - CVE-2025-13526 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13526

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from the wa_order_thank_you_override function within the plugin's thank-you page handler, which processes order IDs directly from user input without implementing proper authorization checks.

When a customer completes an order, the plugin generates a thank-you page with the order details. The vulnerability allows any user—authenticated or not—to access order information belonging to other customers by simply modifying the order ID parameter in the request URL. This represents a classic Insecure Direct Object Reference pattern where the application trusts user-supplied identifiers without verifying ownership or access permissions.

The attack requires no special privileges or user interaction, making it trivially exploitable over the network. While the vulnerability is limited to information disclosure (confidentiality impact), the nature of the exposed data—including personally identifiable information, payment methods, and complete order histories—makes this a significant privacy and compliance concern for affected e-commerce sites.

Root Cause

The root cause lies in the missing validation of user-controlled keys within the wa_order_thank_you_override function. The vulnerable code located at line 126 of wa-order-thank-you.php accepts an order ID parameter without verifying that the requesting user has legitimate access to view that order's information. The function fails to implement proper authorization controls such as checking order ownership, user session validation, or capability verification before returning sensitive order data.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. An unauthenticated attacker can enumerate order IDs sequentially or predictively to harvest customer data from vulnerable WordPress installations. The attack requires no user interaction and can be automated to extract large volumes of sensitive customer information.

The attacker simply needs to:

1. Navigate to a legitimate order thank-you page URL
2. Modify the order ID parameter in the URL to a different value
3. Access order details belonging to other customers without any authentication

This type of horizontal privilege escalation through IDOR vulnerabilities is particularly dangerous in e-commerce contexts where customer PII and payment information are at stake.

Detection Methods for CVE-2025-13526

Indicators of Compromise

• Unusual access patterns to the thank-you page endpoint with sequential or randomized order IDs
• Multiple requests from single IP addresses to /wp-content/plugins/oneclick-whatsapp-order/ paths with varying order parameters
• Access logs showing unauthenticated requests to order confirmation pages that should require authentication
• High-volume enumeration attempts targeting the wa_order_thank_you_override function

Detection Strategies

• Monitor web server access logs for unusual patterns of requests to the plugin's thank-you page endpoint with varying order ID parameters
• Implement rate limiting on order detail endpoints to detect and block enumeration attempts
• Configure web application firewall (WAF) rules to alert on sequential parameter manipulation patterns
• Review audit logs for access to order data from IP addresses not associated with the original customer

Monitoring Recommendations

• Enable detailed access logging for WordPress plugin directories and order-related endpoints
• Set up alerts for high-frequency access to order confirmation URLs from single sources
• Monitor for data exfiltration patterns indicating bulk customer information harvesting
• Implement anomaly detection for unusual access patterns to customer order data

How to Mitigate CVE-2025-13526

Immediate Actions Required

• Update the OneClick Chat to Order plugin to a patched version immediately
• Review access logs to determine if the vulnerability has been exploited
• Notify affected customers if evidence of data exposure is discovered
• Consider temporarily disabling the plugin until the patch is applied

Patch Information

A security update addressing this vulnerability is available. The fix was committed in WordPress Changeset 3391625, which adds proper authorization validation to the wa_order_thank_you_override function. Site administrators should update to the latest version of the plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

For detailed technical analysis of the vulnerability, refer to the Wordfence Vulnerability Analysis. The vulnerable source code can be examined at the WordPress Plugin Source Code repository.

Workarounds

• Implement WAF rules to restrict access to the thank-you page endpoint to authenticated users only
• Add server-level access controls requiring authentication for order-related plugin endpoints
• Temporarily disable the OneClick Chat to Order plugin until an update can be applied
• Consider implementing additional nonce verification at the server level for order detail requests

# Example .htaccess rules to restrict access to vulnerable endpoint
<Files "wa-order-thank-you.php">
    Order Deny,Allow
    Deny from all
    # Allow only authenticated WordPress admin access
    Allow from 127.0.0.1
</Files>