CVE-2025-13389 is an authorization bypass vulnerability (CWE-639) in the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress. The issue is due to the absence of a capability check in the get_order_by_id() function across all versions up to and including 14. This allows unauthenticated attackers to retrieve sensitive WooCommerce order information and private conversations between customers and store administrators by specifying arbitrary order IDs. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS v3.1 base score is 5.3, reflecting a medium severity impact primarily on confidentiality.

An attacker can view sensitive WooCommerce order details and private messages between customers and store administrators without authentication. This unauthorized data disclosure impacts the confidentiality of customer and order information. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or disabling it if possible to prevent unauthorized data exposure. Monitor vendor channels for updates and apply patches promptly once available.