WordPress plugin “Admin and Customer Messages After Order” for WooCommerce: OrderConvo security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A missing authorization vulnerability exists in the WordPress Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin, which stems from a privilege checking...

CVE-2025-10162 OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users before version 15.0 and any authenticated user such as a Subscriber versions 15.0 to 15.1 to read...