The vulnerability resides in the Chat On Desk Order Notifications WordPress plugin prior to version 1.0.9. It fails to confirm the one‑time password (OTP) before carrying out a password‑reset request, allowing attackers who are not logged in to overwrite a user’s password. If the plugin’s SMS OTP reset feature is active, the attacker can reset any user’s password, including that of an administrator, and thereby seize control of the account. This results in full compromise of the affected site’s administrative interface and any sensitive data the user can access.

The affected product is the Chat On Desk Order Notifications plugin for WordPress. All installations using a version earlier than 1.0.9 are vulnerable, regardless of the host server or WordPress theme employed. No specific vendor name is listed, but the plugin is distributed as a community WordPress add‑on and may be installed on both shared and dedicated hosting environments.

The EPSS score is under 1 %, indicating a low probability of public exploitation at this time, and the vulnerability is not yet included in the CISA KEV catalog. The CVSS score of 8.1 places this flaw in the high severity range. Nevertheless, the potential impact is severe because unauthenticated attackers can take over any user account. The attack path requires an attacker to trigger a password reset via the plugin’s public interface, bypass the OTP check, and submit a new password. As no authentication is required to drive the chain, automated scripts could be used to compromise multiple sites.