Chat On Desk resets passwords without verifying the SMS code
Chat On Desk Order Notifications before 1.0.9 processes a password-reset request without confirming that the SMS one-time password was successfully validated. When SMS OTP password reset is enabled, an unauthenticated attacker can select an arbitrary user, set a new password and take over the account, including an Administrator account. The published record does not disclose the reset endpoint or action, user and password parameters, OTP-state field or reset function.
- Component
- Chat On Desk Order Notifications
- Plugin slug
chat-on-desk-order-notifications- Affected
- < 1.0.9
- Safe version
1.0.9- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Chat On Desk Order Notifications to 1.0.9 or later. Disable its SMS password-reset flow until updated, review password changes and logins for affected accounts, invalidate sessions, reset credentials through a trusted channel, and investigate administrator activity if takeover may have occurred.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.