PT-2025-48015 · Unknown+1 · Woocommerce+1

Published 2025-11-25 · Updated 2025-11-25 · CVE-2025-13452

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress versions up to and including 14

Description The software is susceptible to a missing authorization issue. A flawed permission check in the REST API permission callback allows attackers to bypass authentication when no nonce is provided. This enables unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation. Attackers can achieve this by directly calling the REST endpoint with controlled user id, order id, and context parameters.

Recommendations Versions prior to and including 14 should be updated.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13452

Affected Products

Orderconvo

Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13452 · Security Note
• https://twitter.com/CVEnew/status/1993225833264378267 · Twitter Post
• https://t.me/CVEtracker/38178 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3439999 · Note
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1993268754222846133 · Twitter Post
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113 · Note
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L56 · Note
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56 · Note