CVE-2025-13389: WordPress OrderConvo Data Exposure Flaw

CVE-2025-13389 Overview

CVE-2025-13389 affects the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress. The vulnerability stems from a missing capability check on the get_order_by_id() function in the plugin's REST API handler. All versions up to and including version 14 are affected.

Unauthenticated attackers can supply an arbitrary WooCommerce order ID to retrieve sensitive order details and private messages exchanged between customers and store administrators. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key, a form of Insecure Direct Object Reference.

Critical Impact
Unauthenticated attackers can enumerate WooCommerce order IDs and read customer order data along with private conversation threads with store staff, exposing personally identifiable information and business communications.

Affected Products

Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress
All versions up to and including version 14
WordPress sites running WooCommerce with the OrderConvo plugin installed

Discovery Timeline

2025-11-25 - CVE-2025-13389 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13389

Vulnerability Analysis

The OrderConvo plugin exposes a REST API endpoint that returns order details and message threads. The handler invokes get_order_by_id() in includes/wprest.class.php around line 142 without verifying the requester's identity or capability to read the referenced order. Because the endpoint accepts an order ID from the request and returns the associated data directly, an attacker only needs to iterate numeric order IDs to enumerate every order stored by the shop.

Exposed data includes WooCommerce order details and the full private conversation between the customer and administrators. This creates an information disclosure condition that violates the intended access model, where only the order owner and authorized shop staff should be able to view these records.

Root Cause

The root cause is a missing authorization check inside the REST callback. WordPress REST routes require an explicit permission_callback that validates the current user against a WooCommerce capability such as view_order or manage_woocommerce, or verifies ownership through the order's customer ID. The vulnerable handler either omitted the permission callback or returned true unconditionally, allowing anonymous requests.

Attack Vector

Exploitation requires only network access to the target site. An attacker sends unauthenticated HTTP requests to the plugin's REST endpoint, substituting sequential integers for the order ID parameter. Each successful response returns order metadata and message history. No authentication, no user interaction, and no elevated privileges are required. The vulnerability is described in the Wordfence Vulnerability Report and the fix is tracked in WordPress Changeset #3439999.

Refer to the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2025-13389

Indicators of Compromise

Unauthenticated HTTP GET requests to the plugin's REST namespace referencing sequential or randomized order IDs
Elevated request volume to /wp-json/ routes registered by the OrderConvo plugin from a single source IP
Access log entries showing successful 200 responses to REST calls without an authenticated wordpress_logged_in cookie or nonce

Detection Strategies

Review WordPress and web server access logs for anomalous enumeration patterns against plugin REST endpoints
Correlate REST endpoint requests with response sizes to identify bulk data extraction attempts
Deploy a Web Application Firewall rule that blocks unauthenticated calls to the OrderConvo REST route until the plugin is patched

Monitoring Recommendations

Enable WooCommerce and WordPress activity logging to capture REST API access with source IP and user context
Alert on high-frequency requests to /wp-json/orderconvo/ or similar plugin-registered namespaces
Monitor outbound traffic from the web server for unusual data volumes that could indicate scraped order records

How to Mitigate CVE-2025-13389

Immediate Actions Required

Update the OrderConvo plugin to a version released after WordPress Changeset #3439999, which adds the missing capability check
If a patched version is not yet available in your environment, deactivate the plugin until it can be updated
Audit web server logs since plugin installation for unauthenticated access to plugin REST routes and assess data exposure

Patch Information

The vendor addressed the issue in WordPress Changeset #3439999 by adding an authorization check to the affected REST callback. Administrators should upgrade to the fixed release published on the WordPress plugin repository. The vulnerable code path is documented in the WordPress Plugin Source Code.

Workarounds

Block unauthenticated access to the plugin's REST endpoints at the WAF or reverse proxy layer
Restrict the WordPress REST API to authenticated users for sensitive namespaces using a rest_authentication_errors filter
Notify affected customers if log analysis indicates that order data or private messages were disclosed

bash

# Example WAF rule to block unauthenticated access to the plugin REST route
# (adjust the namespace to match the plugin's registered route)
location ~* /wp-json/orderconvo/ {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}