https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T15:27:54.785433+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-30595 cnvd-2025-30595 2026-10-14T15:27:54.842565+00:00 cnvd-2025-30595 https://cve.radiocsirt.org/vuln/euvd-2026-284214 EUVD-2026-284214 2026-10-14T15:27:54.842600+00:00 EUVD-2026-284214 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13526 fkie_cve-2025-13526 2026-10-14T15:27:54.842614+00:00

The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order_thank_you_override' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view sensitive customer information including names, email addresses, phone numbers, billing/shipping addresses, order contents, and payment methods by simply changing the order ID in the URL.

 https://cve.radiocsirt.org/vuln/ghsa-w368-45vp-6vpx GHSA-w368-45vp-6vpx 2026-10-14T15:27:54.842646+00:00

The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order_thank_you_override' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view sensitive customer information including names, email addresses, phone numbers, billing/shipping addresses, order contents, and payment methods by simply changing the order ID in the URL.