CyberRota Analysis
AI-GeneratedThe Chat On Desk Order Notifications plugin for WordPress prior to version 1.0.9 is vulnerable due to a lack of verification for one-time password validation during password reset requests. This flaw allows unauthenticated attackers to reset passwords for any user, including administrators, potentially leading to account takeovers. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this critical security risk.
Original NVD Description
The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.