# CVE-2025-10162: Admin and Customer Messages After Order for WooCommerce: OrderConvo - Path Traversal

> Live exploitation tracking for CVE-2025-10162 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-10162

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** N-Media Admin and Customer Messages After Order for WooCommerce: OrderConvo
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** wordpress, cms, ecommerce

## Description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack

## CrowdSec analysis

[CVE-2025-10162](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-10162) is a path traversal vulnerability in the Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin prior to version 14. This flaw allows unauthenticated attackers to read or download arbitrary files from the server by exploiting improper file path validation, potentially exposing sensitive information and configuration data.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-10162 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-10162 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/wp-json/wooconvo/v1/download-file` endpoint by manipulating the `filename` parameter with path traversal sequences (e.g., `../../../../wp-config.php`) to read or download sensitive files from vulnerable WordPress sites.

## Timeline

- 2025-10-07: CVE Published. CVE-2025-10162 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2025-10162 exploitation attempts against the CrowdSec Network.
- 2026-05-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-10162 for the first time.

## References

- https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10162.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-10162) follows observed exploitation activity for CVE-2025-10162. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.