High severity8.6NVD Advisory· Published Oct 7, 2025· Updated Oct 12, 2026
CVE-2025-10162
CVE-2025-10162
Description
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <14
- Range: <15.0, 15.0-15.1
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.