CVE-2025-10162

OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack

Affected

Admin and Customer Messages After Order for WooCommerce: OrderConvo

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 WPSCAN

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

4.44% chance of exploitation in the next 30 days, 91st percentile

Nuclei

high · CWE-22

Published

2025-10-07

Updated

2026-10-12

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/
• diamorphine666/CVE-2025-10162-Exploit0★ · 2026-05-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10162.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52607

References

• CVE Record
• NVD entry

Related

• CVE-2024-51482
• CVE-2024-7928
• CVE-2025-55182
• CVE-2025-60787
• CVE-2026-0770
• CVE-2026-0926