What the vulnerability does
01Description
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file type validation in the upload_file() function in all versions up to, and including, 13.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files on the affected site's server which may make remote code execution possible and is confirmed to make Cross-Site Scripting possible.
Explanation of Vulnerability in Simple Terms
02Summary
The OrderConvo plugin for WooCommerce contains an unrestricted file upload vulnerability affecting versions up to 13.2. An authenticated user with low privileges can upload files by interacting with the plugin's interface, potentially allowing them to store malicious files on the server. The vulnerability has limited scope but can affect site integrity and confidentiality.
What an attacker can do
03Attacker Capabilities
Upload files to the server without proper validation or restrictions.
Potential impact on your site
04Site Impact
Malicious files could be stored on your server, potentially compromising site integrity or exposing sensitive data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account (e.g., customer or subscriber) and interact with the plugin's upload interface.
Key dates
06Disclosure timeline
January 16, 2025
CVE published
April 8, 2026
Record updated
