Yüksek CVSS 8.6
CVE-2025-10162: CVE-2025-10162: güvenlik açığı
Açıklama (NVD)
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
Özet bilgiler
- CVSS v3.1
- 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - EPSS
- %4,40 (yüzdelik 91)
- Yama
- Yok / bilinmiyor