Threat Entry Updated 2025-11-25

CVE-2025-13389 - Admin And Client Message After Order For Woocommerce Plugin

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.

PLUGIN Admin And Client Message After Order For Woocommerce

CVE-2025-13389

MEDIUM CVSS 5.3 2025-11-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-11-25

CVE-2025-13452 - Admin And Client Message After Order For Woocommerce Plugin

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.

PLUGIN Admin And Client Message After Order For Woocommerce

CVE-2025-13452

MEDIUM CVSS 4.3 2025-11-25

Risk Score

Open Full Technical Breakdown