BaseFortify

Publication date: 2025-11-25

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-25

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-11-25

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13389

EUVD

EUVD-2025-199576

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	woocommerce	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress. It is caused by a missing capability check in the get_order_by_id() function in all versions up to and including version 14. This flaw allows unauthenticated attackers to access sensitive WooCommerce order details and private conversation messages between customers and store administrators by providing an arbitrary order ID.

Impact Analysis

The vulnerability can impact you by allowing unauthorized and unauthenticated attackers to view sensitive order information and private messages related to WooCommerce orders. This could lead to exposure of confidential customer data and private communications, potentially harming customer trust and privacy.

Hi! I’m here to help you understand CVE-2025-13389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70