WordPress Plugin Vulnerabilities
OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read
Description
The plugin does not validate the path of files to be downloaded, which could allow unauthenticated users (in versions before 15.0) and any authenticated user, such as a Subscriber (in versions 15.0 to 15.1), to read arbitrary files on the server via a path traversal attack. The fix released in version 14 was incomplete, and no fixed version is currently available.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
TRAVERSAL
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Khaled Alenazi (Nxploited)
Submitter
Khaled Alenazi (Nxploited)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2025-09-16 (about 1 year ago)
Added
2025-09-16 (about 1 year ago)
Last Updated
2026-10-12 (about 7 days ago)
