CVE-2026-14309
Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.
| Vendor | unknown |
| Product | chat on desk order notifications |
| Published | Aug 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown chat on desk order notifications
Be the first to know when new unknown vulnerabilities affecting unknown chat on desk order notifications are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Chat On Desk Order Notifications
0 < 1.0.9
References
Credits
moonge WPScan