WordPress · Hippoo Mobile App For Woocommerce · CVE-2026-10580
**Name of the Vulnerable Software and Affected Versions**
Hippoo Mobile App for WooCommerce versions prior to 1.9.5
**Description**
An authentication bypass exists that allows for administrator account takeover. The issue stems from a logic conflation in the `get user permissions()` function within `HippooPermissions`, which returns an identical null sentinel for both administrators and unauthenticated visitors. The `has role access()` function interprets this value as full administrator access, leading `override extension permission callback()` to assign ` return true` as the permission callback for all WordPress and WooCommerce REST routes cloned under the '/wc-hippoo/v1/ext/' endpoint by `re register external routes()`. Additionally, the `block unauthorized access()` pre-dispatch guard fails to block unauthenticated users due to the same logic error. This allows unauthenticated attackers to invoke core REST endpoints without credentials, specifically by sending a POST request to '/wc-hippoo/v1/ext/wp/v2/users/<id>' with a `password` variable in the request body to reset the password of any user, including the site administrator.
**Recommendations**
Update to a version later than 1.9.4.