The OneClick Chat to Order WordPress plugin contains an Insecure Direct Object Reference that allows unauthenticated users to retrieve confidential customer information such as names, emails, phone numbers, billing and shipping addresses, order contents and payment methods. The vulnerability stems from missing validation on the "wa_order_thank_you_override" endpoint, which is classified as a confidentiality breach (CWE-200).

The flaw is present in the OneClick Chat to Order plugin by walterpinem and affects every release up to and including version 1.0.8. Any WordPress site that has a vulnerable version of this plugin installed is susceptible to the data exposure attack.

The CVSS base score of 7.5 indicates high severity. An EPSS score of less than 1% suggests a very low probability of large-scale exploitation, yet the lack of authentication requirements means that any user can manifest the flaw by altering the order ID in the URL. The attack path is straightforward: a malicious actor iterates or guesses order identifiers in the thank‑you endpoint to harvest sensitive data. The vulnerability is not currently listed in the CISA KEV catalog, but its potential for privacy violations and downstream fraud remains significant.