CVE-2025-10162

HighCVSS 8.6/10Last modified Oct 12, 2026

Description

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2025
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-101636.5The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shorCVE-2025-101647.3A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_fCVE-2025-101656.4The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all veCVE-2025-101666.4The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all veCVE-2025-101676.4The Stock History & Reports Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_CVE-2025-101686.4The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versionCVE-2025-101698.8A weakness has been identified in UTT 1200GW up to 3.0.0-170831. Affected by this issue is some unknown functionality of the file /goform/CoCVE-2025-10179.8Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of CVE-2025-101708.8A security vulnerability has been detected in UTT 1200GW up to 3.0.0-170831. This affects the function sub_4B48F8 of the file /goform/formApCVE-2025-101718.8A vulnerability was detected in UTT 1250GW up to 3.2.2-200710. This vulnerability affects the function sub_453DC of the file /goform/formConCVE-2025-101728.8A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/formPictureUrl. ExecutiCVE-2025-101732.7The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized acce