CVE-2025-13526 is an Insecure Direct Object Reference vulnerability (CWE-200) in the OneClick Chat to Order WordPress plugin by walterpinem. The issue arises from missing validation on a user-controlled key within the 'wa_order_thank_you_override' function, enabling unauthenticated attackers to enumerate order IDs and retrieve sensitive customer data. This vulnerability affects all versions up to and including 1.0.8. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Successful exploitation allows unauthorized disclosure of sensitive customer information such as personal identifiers, contact details, billing and shipping addresses, order contents, and payment methods. This exposure can lead to privacy violations and potential downstream risks like identity theft or fraud. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin functionality where possible, and monitor for unusual access patterns. Avoid exposing order identifiers in URLs or implement additional access controls to validate user authorization for order data. Stay updated with vendor communications for any forthcoming patches or official mitigations.