Admin and Customer Messages After Order for WooCommerce: OrderConvo, CVE-2025-13389

CVE, Research URL: CVE-2025-13389
Home page URL: Security reports for Admin and Customer Messages After Order for WooCommerce: OrderConvo
Application: Admin and Customer Messages After Order for WooCommerce: OrderConvo
Published on: Nov 25, 2025
Research Description: The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
Affected versions: max 14.
Status: vulnerable