CVE-2025-13452: OrderConvo WooCommerce Auth Bypass Flaw

CVE-2025-13452 Overview

The Admin and Customer Messages After Order for WooCommerce plugin (OrderConvo) for WordPress contains a missing authorization vulnerability affecting all versions up to and including 14. The flaw resides in a REST API permission callback that returns true when no nonce is supplied. Attackers can call the REST endpoint directly with attacker-controlled user_id, order_id, and context parameters. This lets them impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation. The weakness is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated attackers with minimal privileges can impersonate arbitrary WordPress users and inject fraudulent messages into any WooCommerce order thread, enabling social engineering against customers and store operators.

Affected Products

• Admin and Customer Messages After Order for WooCommerce (OrderConvo) plugin for WordPress
• All plugin versions up to and including version 14
• WordPress sites running WooCommerce with the OrderConvo plugin installed

Discovery Timeline

• 2025-11-25 - CVE-2025-13452 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13452

Vulnerability Analysis

The vulnerability exists in the plugin's REST API implementation within wprest.class.php. The permission callback registered on the REST route contains inverted logic: when the request lacks a valid nonce, the callback returns true and grants access rather than denying it. This turns the authorization control into an authorization bypass.

Because the endpoint also accepts user_id, order_id, and context as client-supplied parameters, the server trusts caller-provided identity. An attacker calling the endpoint without a nonce satisfies the flawed check and can specify any user identifier as the message author. The vulnerability is scoped to integrity impact on order conversations, not full account takeover.

Root Cause

The root cause is a logic error in the REST API permission_callback. Secure WordPress REST endpoints must return a permission decision derived from the current user's capabilities. Here the callback treats the absence of a nonce as authorization to proceed. Combined with reliance on client-controlled parameters for the acting user identity, this produces the [CWE-639] Insecure Direct Object Reference / authorization bypass condition.

Attack Vector

Exploitation is remote and network-based. An attacker crafts an HTTP request directly to the vulnerable REST route exposed by the plugin, omits the nonce header, and supplies chosen values for user_id, order_id, and context. The server accepts the request and writes a message attributed to the specified user into the target order. See the Wordfence Vulnerability Report and the WordPress Plugin Code - Line 56 for the specific callback that returns true on missing nonce.

// Real exploitation code is not published. Refer to the Wordfence advisory
// and the plugin source at wprest.class.php lines 56 and 113 for details.

Detection Methods for CVE-2025-13452

Indicators of Compromise

• Unexpected messages appearing in WooCommerce order conversations attributed to administrators or customers who did not author them.
• HTTP requests to the plugin's REST routes under /wp-json/ targeting the OrderConvo message endpoints without a valid X-WP-Nonce header.
• Requests containing explicit user_id, order_id, and context parameters from unauthenticated or low-privilege sessions.

Detection Strategies

• Review web server and WordPress access logs for POST or PUT requests to the plugin's REST namespace originating from unusual IP addresses or without prior authentication flow.
• Correlate order message creation timestamps against admin session activity to identify messages produced outside legitimate admin sessions.
• Deploy WordPress security plugins or WAF rules that validate the presence and correctness of REST nonces on plugin endpoints.

Monitoring Recommendations

• Enable audit logging for all order conversation writes, capturing source IP, user agent, and authentication state.
• Alert on any REST API calls to the OrderConvo endpoints that lack the expected nonce or referer headers.
• Monitor for spikes in message creation volume across multiple orders in short time windows, which suggests automated abuse.

How to Mitigate CVE-2025-13452

Immediate Actions Required

• Update the OrderConvo plugin to a version newer than 14 as soon as the vendor publishes a patched release.
• If no fixed version is available, deactivate and remove the plugin until the vendor addresses the flawed permission callback.
• Audit existing WooCommerce order conversations for suspicious messages and notify affected customers of any fraudulent content.

Patch Information

Refer to WordPress Changeset #3439999 for vendor code changes and the Wordfence Vulnerability Report for the current fix status. Administrators should verify the installed plugin version against the latest release on the WordPress plugin repository.

Workarounds

• Block direct access to the plugin's REST API routes at the web server or WAF layer for unauthenticated requests.
• Enforce nonce validation on all /wp-json/ requests targeting the OrderConvo namespace through a security plugin ruleset.
• Restrict WooCommerce customer account registration and require strong authentication to raise the barrier for attackers who need any authenticated session.

# Example NGINX rule to block unauthenticated access to the plugin REST namespace
location ~ ^/wp-json/orderconvo/ {
    if ($http_x_wp_nonce = "") {
        return 403;
    }
}