OrderConvo CVE-2025-10162

Exploitation targets the plugin's file-download handler, which accepts a file path parameter and does not validate or canonicalize it, permitting '../' directory traversal to read files outside the intended directory. No authentication, user interaction, or non-default setting is required (AV:N/AC:L/PR:N/UI:N) - any site with the OrderConvo plugin installed and active at a version before 14 is exposed in its default configuration. The primary limiting factors are: the target must have this specific plugin installed and activated at a pre-14 version, and impact is confined to reading files the web server process can access (read-only; no write, code execution, or availability impact). Installs already updated to version 14 or later are not affected.

Multiple signals converge on genuine priority. CVSS 8.6 reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) flaw requiring no user interaction (UI:N) with a scope change (S:C) and high confidentiality impact (C:H, I:N/A:N) - consistent with unauthenticated arbitrary file read via path traversal. EPSS of 3.89% sits in the 90th percentile, which is elevated for a plugin CVE and aligns with the fact that publicly available exploit code exists (Exploit-DB entry 52607 and a ProjectDiscovery Nuclei template), meaning mass opportunistic scanning is realistic and automatable. This is NOT a high-CVSS-but-low-real-risk case: the combination of zero authentication, low complexity, and ready-made tooling makes commodity exploitation likely. The main tempering factor is that the product is a specific WooCommerce add-on rather than ubiquitous infrastructure, and the issue is read-only (no integrity or availability impact). No CISA KEV listing is present in the input, so active in-the-wild exploitation is NOT confirmed - the elevated EPSS and POC availability indicate opportunity and likelihood, not evidence of ongoing campaigns.

An unauthenticated attacker locates a WordPress site running the OrderConvo plugin (version before 14) and sends a crafted request to the vulnerable file-download endpoint containing directory-traversal sequences. Because the plugin fails to validate the supplied file path, the server returns arbitrary files such as wp-config.php, exposing database credentials and secret keys. Public exploit code exists (Exploit-DB 52607 and a Nuclei template), so this can be run at scale with off-the-shelf tooling.