CVE-2025-13389

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13389", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T21:12:44.956Z", "datePublished": "2025-11-25T07:28:21.828Z", "dateUpdated": "2026-04-08T17:09:12.024Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:12.024Z"}, "affected": [{"vendor": "nmedia", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID."}], "title": "Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9149d2c6-b6c7-430d-8886-c8c5de483220?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L142"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L142"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439999/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-11-24T19:18:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T14:57:10.662922Z", "id": "CVE-2025-13389", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:58:05.646Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13389", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T14:57:10.662922Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:57:13.699Z"}}], "cna": {"title": "Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "nmedia", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T19:18:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9149d2c6-b6c7-430d-8886-c8c5de483220?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L142"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L142"}], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-25T07:28:21.828Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13389", "state": "PUBLISHED", "dateUpdated": "2025-11-25T14:58:05.646Z", "dateReserved": "2025-11-18T21:12:44.956Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T07:28:21.828Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "vendor": "nmedia", "versions": [{"lessThanOrEqual": "14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID."}, {"lang": "es", "value": "El plugin Admin and Customer Messages After Order for WooCommerce: OrderConvo para WordPress es vulnerable al acceso no autorizado de datos debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n 'get_order_by_id()' en todas las versiones hasta la 14, inclusive. Esto hace posible que atacantes no autenticados vean detalles sensibles de pedidos de WooCommerce y mensajes de conversaci\u00f3n privados entre clientes y administradores de la tienda para cualquier pedido al proporcionar un ID de pedido arbitrario."}], "id": "CVE-2025-13389", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13389", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T14:57:10.662922Z", "version": "2.0.3"}}]}, "published": "2025-11-25T08:15:51.010", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L142"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L142"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3439999/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9149d2c6-b6c7-430d-8886-c8c5de483220?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:59:20.968480+00:00", "value": {"mitigation_remediation": ["Upgrade the Plugin to version 15 or later which includes the missing capability check on get_order_by_id()", "If an upgrade is not immediately possible, restrict access to the plugin\u2019s REST endpoints using a web\u2011application firewall or host\u2011based rule to allow only authenticated users to invoke them", "Regularly review WooCommerce order logs and implement monitoring to detect unauthorized access attempts and identify any compromised order data"], "summary": {"action": "Apply Update", "impact": "Information Disclosure \u2013 Unauthenticated Access to Order Details"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin at version 14 or earlier is affected. The vulnerability exists in all versions up to and including 14 of the plugin and impacts sites that use WooCommerce to manage orders. Sites that have upgraded beyond version 14 are not covered by this issue.", "description_and_impact": "The vulnerability in the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin originates from a missing capability check in the get_order_by_id() function. This oversight allows attackers who do not have administrative privileges to call a REST endpoint and retrieve sensitive WooCommerce order information and private conversation messages between customers and administrators. The flaw is a classic authorization bypass (CWE\u2011639) and its impact is the exposure of confidential order data to unauthenticated actors.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that, at the time of this assessment, exploit activity for this vulnerability is expected to be low. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically send an unauthenticated HTTP request to the plugin\u2019s REST API, supplying any order ID to retrieve order details and private conversation messages. No special credentials or additional access are required to exploit the flaw."}}}}, "created": "2025-11-27T09:45:29.558166+00:00", "updated": "2026-04-21T18:00:11.748669+00:00", "vendors": ["woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}