CVE-2025-13389: Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getorderbyid() function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13389?
CVE-2025-13389 is considered a critical vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2025-13389?
To fix CVE-2025-13389, update the WooCommerce OrderConvo plugin to the latest version that includes the necessary capability checks.
Who is affected by CVE-2025-13389?
Any user of the WooCommerce OrderConvo plugin up to version 14 is affected by CVE-2025-13389.
What type of vulnerability is CVE-2025-13389?
CVE-2025-13389 is a vulnerability caused by a missing capability check, leading to unauthorized access to order data.
Can CVE-2025-13389 lead to data breaches?
Yes, CVE-2025-13389 can lead to data breaches by allowing unauthorized users to access sensitive order information.