CVE-2025-13452: 
WordPress vulnerability analysis and mitigation

CVE-2025-13452 affects the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress in all versions up to and including version 14. The vulnerability was discovered and reported by Wordfence, with the initial disclosure date of November 25, 2025 (NVD CVE).

The vulnerability is classified as a Missing Authorization issue (CWE-639) due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD CVE).

The vulnerability allows unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation. This is achieved by directly calling the REST endpoint with controlled userid, orderid, and context parameters (NVD CVE).

Users should update their Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin to a version newer than 14, once available. In the meantime, website administrators should consider disabling the plugin if it's not critical to their operations (Wordfence Intel).