Vulnerability · Published Oct 7, 2025 · Assigned by WPScan

CVE-2025-10162OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read

High 8.6

In plain English

A high-severity security flaw in Admin and Customer Messages After Order for WooCommerce: OrderConvo from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)4.4%top 8.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Admin and Customer Messages After Order for WooCommerce: OrderConvo	0 – through 15.1

References

https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/ exploit, vdb-entry, technical-description