OrderConvo – Vendor & Customer Messages After Orders
OrderConvo – Vendor & Customer Messages After Orders has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 4 disclosures.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Path Traversal.
Every one of the 5 issues recorded for OrderConvo – Vendor & Customer Messages After Orders has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, most of them (2) reported by Md. Moniruzzaman Prodhan (NomanProdhan). OrderConvo – Vendor & Customer Messages After Orders is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-33566OrderConvo <= 12.4 - Missing Authorization to Arbitrary File Upload
Read the full analysisVulnerability Records

OrderConvo – Vendor & Customer Messages After Orders
Author
N-Media
OrderConvo is a lightweight and efficient WooCommerce plugin that allows vendors and customers to exchange messages after an order is placed. Both admin/vendors and customers can send messages or files related to the order. Customers can access the OrderConvo message box from My Account -> Orders, where each order has its own messaging area. The plugin adds a responsive, AJAX-powered message box on the order details page, ensuring compatibility with all WooCommerce themes. How It Works Watch the Demo Live Demo Instructions * Click here to launch the demo. * Once the demo is live, navigate to Settings > NM Demo. * Click Initialize Demo: OrderConvo to create demo orders and products. * Explore the plugin’s features and functionalities. * Note: If the Messages tab (My Account > Messages) does not work, re-save the permalink settings to resolve the issue. Free Version Features Enable communication between customers and vendors/admins for each order. Unlimited messages per order. Customize message button labels. Customize message placeholder text. OrderConvo Supports Single Store and Marketplace Setups * Fully compatible with single WooCommerce stores. Marketplaces Supported Dokan Marketplace WC Product Vendors MultiVendorX YITH Multi-Vendor WCFM Marketplace PRO Features Send and receive file attachments. Control file types and file size limits. Attach images with automatic thumbnail previews. Email notifications for new messages. Customize email templates using the WooCommerce Email Template Manager. New message alerts on the order page. Rich text editor for enhanced message formatting. Access to a dedicated support forum. New message notifications in the WordPress dashboard. Learn More About PRO Why Use OrderConvo for Vendor-Customer Communication? With over 12 years of experience in WordPress and WooCommerce development, N-Media has received many requests for improved post-order communication. OrderConvo addresses this need, allowing for smooth communication between customers and vendors. Here’s why OrderConvo is a must-have for your store: For Customers: * Customers can request changes to the delivery address or date after placing the order. * They can also modify order quantities or request revisions or replacements, helping avoid negative feedback. For WooCommerce Vendors: * Vendors can provide order updates, share prototypes, or get feedback before final shipment, especially useful for digital goods or custom orders. OrderConvo Add-ons If the free or PRO version doesn’t fully meet your needs, check out our range of OrderConvo Add-ons: OrderConvo AWS S3 Add-on Upload all attachments to AWS S3 for faster and more efficient file management. Simply add your S3 credentials to get started, ideal for large file uploads. OrderConvo Quick Message Add-on Create pre-saved message templates for quick replies, saving time and streamlining communication with customers. OrderConvo Revisions Add-on Allow customers to request revisions before finalizing their orders, perfect for businesses like printing companies that need client approval on designs. OrderConvo Live Chat Add-on Enable real-time communication between vendors and customers with an AJAX-powered live chat. Chat can be disabled when not needed to save server resources. OrderConvo Marketplace Add-on Supports major marketplace plugins like Dokan, MultiVendorX, WCFM, YITH, and WC Product Vendors. Explore All Add-ons Our Top Plugins: WooCommerce Bulk Product Sync – Manage WooCommerce products using Google Sheets™. WooHero – Customize WooCommerce buttons, tabs, and more without writing code. See All Plugins
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C