CVE-2025-10162Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-05); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Red Secure Tech Ltd.@redsecuretech128d
Disclosure
A WordPress OrderConvo path traversal vulnerability (CVE-2025-10162) allows unauthenticated attackers to read wp-config.php and other sensitive files. https://www.redsecuretech.co.uk/blog/post/wordpress-orderconvo-path-traversal-reads-wp-configphp/1214 #WordPress #OrderConvo #CVE #PathTraversal #wpconfig #Unauthenticated #RESTAPI #Diamorphine #InfoSec https://t.co/ZwbIBz2bqj
Post summary
A new WordPress OrderConvo path traversal vulnerability (CVE-2025-10162) is disclosed, allowing unauthenticated attackers to read wp-config.php and other sensitive files, with a blog post link but no active exploitation or patch details.
0101028
61 followersView on X
pdnuclei-bot@pdnuclei_bot156d
Disclosure
🚨 CVE-2025-10162 - high 🚨 WordPress OrderConvo < 14 - Path Traversal > WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerabi... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-10162 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE‑2025‑10162, a path‑traversal flaw in WooCommerce OrderConvo versions below 14, but it does not provide PoC, exploitation code, active exploitation evidence, or patch details.
000111.2K
944 followersView on X

Explore more

Back to dashboard