CVE-2025-14270 is an authorization bypass vulnerability in the walterpinem OneClick Chat to Order WordPress plugin versions up to 1.0.9. The plugin fails to properly verify user authorization in the wa_order_number_save_number_field function, enabling authenticated users with Editor or higher privileges to alter WhatsApp phone numbers configured in the plugin. This can lead to redirection of customer orders and messages to attacker-controlled numbers. The CVSS 3.1 base score is 2.7, reflecting low severity with limited impact on integrity only.

The vulnerability allows modification of WhatsApp phone numbers used by the plugin, potentially redirecting customer communications and orders to attacker-controlled numbers. There is no impact on confidentiality or availability. The threat is limited to users with Editor-level or higher privileges, reducing the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level access to trusted users only to reduce risk. Monitor plugin updates from the vendor for a security patch addressing this authorization bypass.