CVE-2025-10162

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

3.63% chance of exploitation in the next 30 days, 89th percentile

Nuclei

high · CWE-22

Published

2025-10-07

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/
• diamorphine666/CVE-2025-10162-Exploit

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10162.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52607

References

• CVE Record
• NVD entry

Related

• CVE-2024-7928
• CVE-2025-55182
• CVE-2026-0770
• CVE-2026-0926
• CVE-2026-23744
• CVE-2026-33017