What’s Vulnerable › Vulnerabilities

CVE-2025-10162: OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-07 · updated 2026-10-12

Description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.

Affected products

• Admin and Customer Messages After Order for WooCommerce: OrderConvo: through 15.1

References

• https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/
• https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/

Get alerted when CVE-2025-10162 or the next vulnerability affects your stack