Skip to content
Sign in
5.3 Medium

CVE-2025-13389 The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to…

Description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.

Affected products and versions

Product Affected versions Fixed in
Admin and Customer Messages After Order for WooCommerce: OrderConvo 14 earliest → 14 No fix stated

Other CVEs of Admin and Customer Messages After Order for WooCommerce: OrderConvo

The 3 CVEs of Admin and Customer Messages After Order for WooCommerce: OrderConvo →
CVE-2025-13452 The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing… 4.3 Medium CVE-2024-13355 The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited… 5.4 Medium
Track this CVE