CVE-2024-13355: Admin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file type validation in the uploadfile() function in all versions up to, and including, 13.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files on the affected site's server which may make remote code execution possible and is confirmed to make Cross-Site Scripting possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13355?
CVE-2024-13355 is considered a high severity vulnerability due to its potential for unauthorized file uploads.
How do I fix CVE-2024-13355?
To fix CVE-2024-13355, update the WooCommerce OrderConvo plugin to version 13.3 or later.
What systems are affected by CVE-2024-13355?
CVE-2024-13355 affects the WooCommerce OrderConvo plugin for WordPress versions up to and including 13.2.
Can CVE-2024-13355 lead to a complete system compromise?
Yes, if exploited, CVE-2024-13355 can allow attackers to upload malicious files, potentially leading to full system compromise.
Is authentication required to exploit CVE-2024-13355?
Yes, exploitation of CVE-2024-13355 requires user authentication, making it less likely to impact unauthenticated users.