WordPress OrderConvo
The OrderConvo WooCommerce Plugin contains a security issue that allows users not logged in to a WordPress account to access arbitrary files located on the WordPress server.
The OrderConvo WordPress Plugin OrderConvo has been tagged with the classification of CVE-2025-10162 for the OrderConvo Path Traversal Vulnerability, which was discovered by researcher Diamorphine. The official name of the OrderConvo for WooCommerce plugin is Admin & Client Message After Order for WooCommerce from Najeeb Media.
The /wp-json/wooconvo/v1/download-file endpoint path for the vulnerable plugin is as follows:
What is the Cause of the Vulnerability
The OrderConvo path traversal vulnerability occurs in the REST API Endpoint of the plugin.
The plugin APIs accept two parameters:
1. The order_id
2. The filename
The order_id parameter allows for the downloading of files related to a specific order.
In earlier versions of this plugin, the order_id parameter was not validated allowing any logged in user to set the order_id to any INTEGER value (e.g. order_id=1) and authenticate.
As for the filename parameter, it contains a path traversal vulnerability that allows the attacker to include ../ sequences in order to exit the original directory.
The Exploit
The proof-of-concept (PoC) for the WordPress OrderConvo path traversal exploit is accomplished with an easy Python script using some form of HTTP (httpx).
The exploit sends a GET request to /wp-json/wooconvo/v1/download-file?order_id=1&filename=../../../../wp-config.php, and when order_id=1 is the target, authentication is bypassed while the ../ sequences travel upwards in the directory tree.
The server will return the contents of wp-config.php, the most critical file in any WordPress site, containing database credentials, authentication unique keys/salts, and other powerful information.
The path traversal vulnerability allows unauthenticated attackers access to read any file that the webserver user has access to.
The Target File
The default target file in the WordPress OrderConvo path traversal exploit is wp-config.php.
In a WordPress installation, wp-config.php is the most critical file as it holds the database name, database username, password, and host information (IP address or DNS name etc.)
It also contains all of the authentication unique cryptographic keys and salts and may contain other configuration items that have a significant sensitivity.
With the database credentials found in wp-config.php, an attacker will be able to access the WordPress database directly and will be able to view all users in the user table, change all of the passwords of all of the users, and will be able to inject malicious code into all pages on the WordPress site.
The Target Configuration File
Within the WordPress directory of an OrderConvo installation, the default target configuration file for exploiting the path traversal vulnerability is wp-config.php.
wp-config.php is an essential component for any WordPress installation as it stores the database name, username, password, and host for the database.
Not only does it store the database connection info, but it also holds the unique keys and salts used for authentication along with other potentially sensitive values associated with the WordPress application.
When an attacker has obtained the database credentials contained within wp-config.php, they can directly connect to the WordPress database where they have the ability to view sensitive user information, change user passwords, or insert malicious data into the WordPress database.
Affected Versions
The WordPress OrderConvo path traversal vulnerability affects version 13.5 of the plugin.
Earlier versions may also be vulnerable, and version 13.5 has been confirmed vulnerable in testing.
Users should check for a patched version of the plugin, and they should update immediately if a fix is available.
The Plugin Functionality
The OrderConvo plugin adds a messaging system between customers and administrators after an order is placed in WooCommerce.
It allows file attachments to be exchanged within conversations, and the download-file endpoint is intended to serve these attachments.
The WordPress OrderConvo path traversal vulnerability turns this legitimate file-serving functionality into an arbitrary file read.
Why Can Authentication Bypass Be Achieved
In order to identify whether a user making a request has permission to view file(s) for a particular order, the order_id parameter will be used. If an attacker sets the order_id parameter to 1 ("order_id=1"), he can assume that there is an order number 1 on most sites, thus exploiting a potential flaw in the plugin where any order_id would bypass the permission check.
The Comment, Convo plugin has demonstrated through this confirmation of the Order Convo Path Traversal attack that access control is fragile, at best, based on parameters only.
What an Attacker Can Read
The WordPress OrderConvo path traversal vulnerability allows attackers to read many types of sensitive files:
1. Configuration files of your WordPress account (wp-config.php and .htaccess) can be read from the internet.
2. The ability to access system files (in Linux) can be done through deep path traversal attacks as well.
3. Additional plugin and theme files may also contain hard-coded credentials (username/password) or other API keys.
4. Backup copies in web accessible directories may have database dumps.
5. Log files may also contain sensitive user information and user input.
With WordPress OrderConvo being vulnerable to a path traversal vulnerability, hackers have a means to exploit this flaw to uncover a wide range of data.
Best Practices to Secure Your WordPress Site
You need to try to protect your WordPress site as soon as possible.
1. Upgrade Your Plugin: You should search for an appropriate version of OrderConvo that has been patched and download it immediately.
2. If you are unable to find a patched version of the plugin, then you must disable it. There is a significant security risk associated with the WordPress OrderConvo path traversal vulnerability, so your safest course of action is to disable the plugin.
3. Check your logs for occurrences of /wp-json/wooconvo/v1/download-file where ../ is present in the filename and take appropriate action.
4. Change Your Database Credentials: If your site has already been compromised, use the wp-config.php file to reset your password and change your legacy database user.
5. Install a Web Application Firewall (WAF). A WAF will help to detect and stop any potentially damaging activity to your web application by identifying any path traversal patterns or sequences within the URL parameters.
Handling of REST API
WordPress REST API is an extremely popular way to interface with WordPress and it is both very effective and very powerful as an API; however, it expands the attack surface area significantly so it is extremely important for plugin authors to implement proper security measures for all REST API endpoints in order to ensure their plugins are as secure as possible.
Lack of proper authentication or authorisation checks on REST API endpoints is one of the common issues with REST API implementations. The WordPress OrderConvo path traversal vulnerability is an example of this type of problem.
The Discoverer (Researcher)
Diamorphine, who is a researcher, discovered a vulnerability in WordPress along the OrderConvo path. On May 31, 2026, Diamorphine has also published a working proof-of-concept with user instructions and documentation to assist users with the WordPress OrderConvo path traversal vulnerability which has been assigned the CVE number CVE-2025-10162.
Final Thoughts
The WordPress OrderConvo path traversal vulnerability is quite severe as an information disclosure vulnerability.
An unauthorized user has access to the site through the wp-config.php file by being able to read this file with their database credentials. This position gives them the ability to take full control of WordPress once these credentials have been obtained.
The vulnerability exists because the OrderConvo Plugin does not properly authenticate and authorize users through the REST API endpoint of the plugin, nor does it properly sanitize the filename input for path traversal sequences allowing access to the wp-config.php file.
If you are utilizing OrderConvo, be sure to verify the version you are using, and either update it or disable OrderConvo, as well as look through your access logs for any attempts at exploiting this vulnerability.
Subsequent updates of the OrderConvo Plugin have fixed this vulnerability in newer versions but require you to update.
FAQ Section
What security issue relates to the OrderConvo plugin for WordPress as stated in CVE-2015-10162?
OrderConvo Plugin for WordPress CVE-2015-10162 Path Traversal Vulnerability, due to an error in `/wp-json/wooconvo/v1/download-file` for Version 13.5 of OrderConvo Plugin for WordPress, allows someone other than an authorised user, eg: hacker, to execute a Path Traversal Attack and access files on a server they shouldn't have access to.
What file will an attacker be able to obtain when they exploit this vulnerability?
An attacker will be able to access the wp-config.php file by default. The wp-config.php file contains many sensitive pieces of information about the database associated with a website including Database Connection Information, Database Connection Authentication Keys, and other sensitive information related to that WordPress installation; therefore, this file will provide hackers with all of the information necessary for them to gain substantial access over the database and WordPress installation.
Will an attacker be able to access files that are located outside of the WordPress Directory by exploiting this vulnerability?
Yes, attackers will be able to further exploit the Path Traversal vulnerability by using deeper Path Traversal Strings (i.e. ../), which will allow them to access System-Level Files located outside of the web's Root Directory.
What version of the OrderConvo plugin has the Path Traversal Vulnerability?
Version 13.5 of the OrderConvo plugin has been identified as having the Path Traversal Vulnerability; however, there is a high probability that older versions of the plugin also have the Path Traversal Vulnerability, so users should get patched versions of their respective Installations of the OrderConvo Plugin.
What can I do to protect myself from this vulnerability?
The only way to protect yourself from this vulnerability is to either update to the patched version of the plugin, disable the plugin if you do not want to update/patch the plugin, and look at your access logs for signs of exploitation.
