CVE-2025-13452

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13452", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-19T19:28:16.353Z", "datePublished": "2025-11-25T07:28:20.236Z", "dateUpdated": "2026-04-08T16:43:48.690Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:48.690Z"}, "affected": [{"vendor": "nmedia", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters."}], "title": "Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L56"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439999/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-11-24T19:17:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T15:43:09.338654Z", "id": "CVE-2025-13452", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T15:43:16.139Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13452", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T15:43:09.338654Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T15:43:12.168Z"}}], "cna": {"title": "Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "nmedia", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T19:17:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L56"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439999/"}], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:48.690Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13452", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:48.690Z", "dateReserved": "2025-11-19T19:28:16.353Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T07:28:20.236Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "vendor": "nmedia", "versions": [{"lessThanOrEqual": "14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters."}, {"lang": "es", "value": "El plugin Admin and Customer Messages After Order for WooCommerce: OrderConvo para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 14, inclusive. Esto se debe a una verificaci\u00f3n de permisos defectuosa en la funci\u00f3n de devoluci\u00f3n de llamada de permisos de la API REST que devuelve 'true' cuando no se proporciona un 'nonce'. Esto hace posible que atacantes no autenticados suplanten a cualquier usuario de WordPress e inyecten mensajes arbitrarios en cualquier conversaci\u00f3n de pedido de WooCommerce llamando directamente al endpoint REST con par\u00e1metros 'user_id', 'order_id' y 'context' controlados."}], "id": "CVE-2025-13452", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13452", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T15:43:09.338654Z", "version": "2.0.3"}}]}, "published": "2025-11-25T08:15:51.740", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L56"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3439999/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:32:20.710050+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to a version newer than 14, which includes a proper nonce check in the REST API permission callback.", "If upgrading is not immediately possible, block or remove the vulnerable REST endpoint by configuring the web server or firewall to deny POST requests to the /wp-json/admin-convo/v1/ URL pattern.", "Disable the message feature in the plugin or replace it with a custom solution that enforces authenticated access before accepting message data."], "summary": {"action": "Patch", "impact": "Unauthorized User Impersonation and Message Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to the nmedia\"Admin and Customer Messages After Order for WooCommerce: OrderConvo\" plugin in all versions up to and including version 14. WordPress sites that run WooCommerce and have this plugin installed are potentially exposed.", "description_and_impact": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin is affected by a flawed permission check in its REST API that returns true when no nonce is supplied. This flaw allows an unauthenticated attacker to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation. The weakness is identified as CWE\u2011639, representing a missing authorization control that can be exploited without requiring authentication.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a low\u2011to\u2011medium severity, and the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can simply send a REST request to the plugin\u2019s endpoint with an arbitrary user_id, order_id, and context; if no nonce is present, the request is accepted, allowing message injection and impersonation. Because no authentication is required, the attack surface is wide and does not depend on user credentials."}}}}, "created": "2025-11-26T11:10:54.148388+00:00", "updated": "2026-04-22T16:45:21.451365+00:00", "vendors": ["najeebmedia", "najeebmedia$PRODUCT$admin_and_customer_messages_after_order_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}