Admin and Customer Messages After Order for WooCommerce: OrderConvo - Path Traversal (CVE-2025-10162)

CVE-2025-10162 is a path traversal vulnerability in the Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin prior to version 14. This flaw allows unauthenticated attackers to read or download arbitrary files from the server by exploiting improper file path validation, potentially exposing sensitive information and configuration data.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-10162 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-10162 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the /wp-json/wooconvo/v1/download-file endpoint by manipulating the filename parameter with path traversal sequences (e.g., ../../../../wp-config.php) to read or download sensitive files from vulnerable WordPress sites.