Path Traversal Vulnerability in OrderConvo Plugin for WooCommerce by WordPress
CVE-2025-10162
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 October 2025
Badges
What is CVE-2025-10162?
The OrderConvo WordPress plugin for WooCommerce, prior to version 14, contains a vulnerability that fails to properly validate the paths for downloadable files. This oversight enables an unauthenticated attacker to exploit a path traversal flaw, potentially allowing them to read or download arbitrary files from the server. Such vulnerabilities can lead to unauthorized access to sensitive information, making it crucial for administrators to update to the latest version and secure their installations against such attacks.
Affected Version(s)
Admin and Customer Messages After Order for WooCommerce: OrderConvo 0 < 14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.