CVE-2025-13452

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.

• CWE-639

• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113
• https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L56
• https://plugins.trac.wordpress.org/changeset/3439999/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=cve

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13446A vulnerability has been found in Tenda AC21 16.03.08.16. Th…9.8
• CVE-2025-13447OS Command Injection Remote Code Execution Vulnerability in …6.8
• CVE-2025-13448The CSSIgniter Shortcodes plugin for WordPress is vulnerable…6.4
• CVE-2025-13449A vulnerability was found in code-projects Online Shop Proje…9.8
• CVE-2025-13450A vulnerability was determined in SourceCodester Online Shop…5.4
• CVE-2025-13451A vulnerability was identified in SourceCodester Online Shop…9.8
• CVE-2025-13453A potential vulnerability was reported in some ThinkPlus USB…5.1
• CVE-2025-13454A potential vulnerability was reported in ThinkPlus configur…6.8
• CVE-2025-13455A vulnerability was reported in ThinkPlus configuration soft…7.8
• CVE-2025-13456The ShopBuilder WordPress plugin before 3.2.2 does not sani…6.1
• CVE-2025-13457The WooCommerce Square plugin for WordPress is vulnerable to…7.5
• CVE-2025-13459IBM Aspera Console 3.3.0 through 3.4.8 could allow a privile…4.9