Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-10162. PoCs published by Diamorphine, diamorphine666. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in WordPress OrderConvo plugin (CVE-2025-10162) by crafting a malicious request to the `wp-json/wooconvo/v1/download-file` endpoint, allowing unauthorized file reads (e.g., `wp-config.php`).
Description
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack
Exploits (2)
This exploit demonstrates a path traversal vulnerability in WordPress OrderConvo plugin (CVE-2025-10162) by crafting a malicious request to the `wp-json/wooconvo/v1/download-file` endpoint, allowing unauthorized file reads (e.g., `wp-config.php`).
This is a functional exploit for CVE-2025-10162, a path traversal vulnerability in WordPress OrderConvo plugin versions < 14. It leverages an unauthenticated endpoint to read arbitrary files from the server.
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N