PT-2025-38079 · Undefined · Undefined

Khaled Alenazi · Published 2025-09-16 · Updated 2026-06-02 · CVE-2025-10162

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin versions prior to 14

Description The plugin fails to validate the path of files intended for download. This allows an unauthenticated attacker to perform a path traversal attack, which is a method used to access files and directories that are stored outside the web root folder, resulting in the ability to read or download arbitrary files from the server.

Recommendations Update the plugin to version 14 or later.

Exploit

Fix

Related Identifiers

CVE-2025-10162

Affected Products

Undefined

References · 12

• 🔥 https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986 · Exploit
• 🔥 https://exploit-db.com/exploits/52607 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10162 · Security Note
• https://t.me/cveNotify/137607 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2051557537334587473 · Twitter Post
• https://t.me/CVEtracker/34293 · Telegram Post
• https://twitter.com/Nxploited/status/1967957750329249858 · Twitter Post
• https://twitter.com/CVEnew/status/1975446618187894848 · Twitter Post
• https://twitter.com/cracbot/status/1977328441499287947 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975455335902065143 · Twitter Post
• https://t.me/cveNotify/137671 · Telegram Post
• https://twitter.com/redsecuretech/status/2061796771890626714 · Twitter Post