This vulnerability (CVE-2025-10162) affects the Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin prior to version 14. The plugin fails to properly restrict pathname inputs, enabling unauthenticated attackers to perform path traversal attacks. This allows reading or downloading arbitrary files from the server, impacting confidentiality. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality without affecting integrity or availability.

Successful exploitation allows an unauthenticated attacker to read or download arbitrary files from the server hosting the vulnerable plugin. This compromises the confidentiality of potentially sensitive server files. There is no impact on integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin or disabling it to prevent exploitation.