CVE-2025-14270: 
WordPress vulnerability analysis and mitigation

CVE-2025-14270 is an authorization bypass vulnerability in the OneClick Chat to Order plugin for WordPress, affecting versions up to and including 1.0.9. The flaw allows authenticated attackers with Editor-level access or above to modify WhatsApp phone numbers used by the plugin, redirecting customer orders and messages to attacker-controlled numbers. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 2.7 (Low) (Feedly).

The root cause is a Missing Authorization flaw (CWE-862) in the wa_order_number_save_number_field function of the plugin, which fails to verify whether the requesting user is authorized to perform the action. An authenticated attacker with Editor-level privileges can send a crafted request to this function to overwrite the WhatsApp phone number configuration, as no capability check is enforced server-side. This class of vulnerability is consistently ranked among the most dangerous software weaknesses (OWASP Top Ten 2025: A01 – Broken Access Control) (CWE-862, Feedly).

Successful exploitation allows an attacker to redirect all customer WhatsApp order messages and communications to an attacker-controlled phone number, enabling fraud, order interception, and potential social engineering of customers. The integrity of the plugin's configuration is compromised, while confidentiality and availability are not directly affected. The impact is scoped to the affected WordPress installation and does not provide a path to broader system compromise (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the OneClick Chat to Order plugin at version 1.0.9 or earlier, using tools like WPScan or manual inspection of plugin metadata.
2. Obtain Editor-level access: Authenticate to the target WordPress site with an account that has at least Editor-level privileges (e.g., through compromised credentials or a legitimate account).
3. Craft malicious request: Send a crafted HTTP POST request targeting the wa_order_number_save_number_field function with a modified WhatsApp phone number parameter, bypassing the missing authorization check.
4. Redirect communications: Once the phone number is updated, all customer WhatsApp order messages are redirected to the attacker-controlled number, enabling order fraud or customer impersonation (Feedly).

• Logs: WordPress audit logs or server access logs showing unexpected POST requests to the plugin's settings endpoint (wa_order_number_save_number_field) from Editor-level user accounts.
• Application: Unexpected changes to the WhatsApp phone number configured in the OneClick Chat to Order plugin settings, particularly to numbers not associated with the business.
• User Activity: Editor-level accounts modifying plugin settings outside of normal administrative workflows or business hours.

Users should update the OneClick Chat to Order plugin to a version beyond 1.0.9 that includes a proper authorization check in the wa_order_number_save_number_field function. As an interim measure, administrators should audit Editor-level accounts and restrict plugin settings access to Administrator roles only. Regularly reviewing plugin configuration for unexpected changes to the WhatsApp phone number is also recommended (Feedly).