Threats tagged 'ghsa-w368-45vp-6vpx'

The OneClick Chat to Order WordPress plugin versions up to and including 1.0.8 suffer from an Insecure Direct Object Reference (IDOR) vulnerability in the 'wa_order_thank_you_override' function. This flaw allows unauthenticated attackers to access sensitive customer information by manipulating the order ID in the URL. Exposed data includes names, email addresses, phone numbers, billing and shipping addresses, order details, and payment methods.