CVE-2025-10162: high-severity vulnerability in Admin and Customer Messages After Order for…
OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
56Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.6epss 4.4%
from disclosure to weapon235 days
Published on NVDOct 7
1st PoC+235d
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
public PoCs found — 3
exploitdbwww.exploit-db.com/exploits/52607unverifiedgithubgithub.com/diamorphine666/CVE-2025-10162-Exploit★ 0cve_referencewpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.