The vulnerability in the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin originates from a missing capability check in the get_order_by_id() function. This oversight allows attackers who do not have administrative privileges to call a REST endpoint and retrieve sensitive WooCommerce order information and private conversation messages between customers and administrators. The flaw is a classic authorization bypass (CWE‑639) and its impact is the exposure of confidential order data to unauthenticated actors.

Any WordPress site running the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin at version 14 or earlier is affected. The vulnerability exists in all versions up to and including 14 of the plugin and impacts sites that use WooCommerce to manage orders. Sites that have upgraded beyond version 14 are not covered by this issue.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that, at the time of this assessment, exploit activity for this vulnerability is expected to be low. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically send an unauthenticated HTTP request to the plugin’s REST API, supplying any order ID to retrieve order details and private conversation messages. No special credentials or additional access are required to exploit the flaw.