CVE-2025-13452: Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled userid, orderid, and context parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13452?
The severity of CVE-2025-13452 is considered medium due to the potential for unauthorized access.
How do I fix CVE-2025-13452?
To fix CVE-2025-13452, upgrade the WooCommerce OrderConvo plugin to the latest version beyond 14.
What versions of WooCommerce OrderConvo are affected by CVE-2025-13452?
CVE-2025-13452 affects all versions of the WooCommerce OrderConvo plugin up to and including version 14.
What types of security issues does CVE-2025-13452 present?
CVE-2025-13452 presents a Missing Authorization vulnerability that could allow unauthorized actions via the REST API.
Is there a workaround for CVE-2025-13452 if I cannot update immediately?
There are no known workarounds for CVE-2025-13452, so updating is the recommended solution.