CVE-2024-13355 is a CWE-434 vulnerability in the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress. It arises from insufficient validation of file types in the upload_file() function, allowing authenticated users with low privileges (Subscriber-level and above) to upload potentially dangerous files. This can enable remote code execution and confirmed cross-site scripting attacks. The vulnerability affects all versions up to 13.2. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and low confidentiality and integrity impact with no availability impact.

Authenticated attackers with Subscriber-level access or higher can upload files to the affected WordPress site, potentially enabling remote code execution and cross-site scripting attacks. This compromises the confidentiality and integrity of the site and its users. There is no indication of availability impact. No known exploits are currently reported in the wild.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict user permissions to prevent untrusted users from uploading files and monitor for suspicious file uploads related to this plugin.