What the vulnerability does
01Description
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
Explanation of Vulnerability in Simple Terms
02Summary
OrderConvo, a WooCommerce messaging plugin by nmedia, contains an information disclosure vulnerability in versions 14 and earlier. An unauthenticated attacker can read sensitive data over the network without user interaction. The vulnerability stems from improper access controls that fail to restrict data exposure. Site administrators should update to a version newer than 14.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the plugin without authentication.
Potential impact on your site
04Site Impact
Customer or order data may be exposed to unauthenticated visitors.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 25, 2025
CVE published
April 8, 2026
Record updated
