A path traversal vulnerability in the WordPress plugin OrderConvo (version 13.5 and below) allows unauthenticated attackers to read arbitrary files from the server. The flaw is tracked as CVE-2025-10162.
The issue lies in the wooconvo/v1/download-file REST API endpoint. The filename parameter accepts path traversal sequences like ../../../../wp-config.php, letting attackers escape the web root and access sensitive system or WordPress configuration files.
What makes this particularly dangerous is that the exploit requires no authentication. An attacker only needs to send a crafted GET request to the vulnerable endpoint. The proof-of-concept uses Python’s httpx library to demonstrate file retrieval, but any HTTP client can trigger the vulnerability.
OrderConvo is a plugin for WooCommerce that allows messaging between admins and customers after an order is placed. Sites using this plugin should either update to a patched version or deactivate it immediately. The vulnerability was disclosed on May 31, 2026, and no patch has been confirmed as of this writing.
