Description
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Admin and Customer Messages After Order for WooCommerce: OrderConvo | ≤ 15.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- WordPress OrderConvo 14 - Path Traversal EDB-52607 · webapps · Jun 1, 2026
GitHub 1 repository
-
diamorphine666/CVE-2025-10162-Exploit ★ 0 · May 30, 2026
CVE-2025-10162 Exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress OrderConvo < 14 - Path Traversal http/cves/2025/CVE-2025-10162.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/ exploit vdb-entry technical-description