The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin is affected by a flawed permission check in its REST API that returns true when no nonce is supplied. This flaw allows an unauthenticated attacker to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation. The weakness is identified as CWE‑639, representing a missing authorization control that can be exploited without requiring authentication.

The vulnerability applies to the nmedia"Admin and Customer Messages After Order for WooCommerce: OrderConvo" plugin in all versions up to and including version 14. WordPress sites that run WooCommerce and have this plugin installed are potentially exposed.

The CVSS score of 4.3 indicates a low‑to‑medium severity, and the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can simply send a REST request to the plugin’s endpoint with an arbitrary user_id, order_id, and context; if no nonce is present, the request is accepted, allowing message injection and impersonation. Because no authentication is required, the attack surface is wide and does not depend on user credentials.