CVE-2025-13452

{"id": "CVE-2025-13452", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13452", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T15:43:09.338654Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "nmedia", "product": "Admin and Customer Messages After Order for WooCommerce: OrderConvo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "14"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-25T08:15:51.740", "references": [{"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L56", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439999/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters."}, {"lang": "es", "value": "El plugin Admin and Customer Messages After Order for WooCommerce: OrderConvo para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 14, inclusive. Esto se debe a una verificaci\u00f3n de permisos defectuosa en la funci\u00f3n de devoluci\u00f3n de llamada de permisos de la API REST que devuelve 'true' cuando no se proporciona un 'nonce'. Esto hace posible que atacantes no autenticados suplanten a cualquier usuario de WordPress e inyecten mensajes arbitrarios en cualquier conversaci\u00f3n de pedido de WooCommerce llamando directamente al endpoint REST con par\u00e1metros 'user_id', 'order_id' y 'context' controlados."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security@wordfence.com"}