PT-2025-50304 · WordPress · Hippoo Mobile App For Woocommerce

Moose Love · Published 2025-12-10 · Updated 2025-12-15 · CVE-2025-13339

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce plugin for WordPress versions up to and including 1.7.1

Description The Hippoo Mobile App for WooCommerce plugin for WordPress contains a flaw that allows unauthorized access to server files. This is due to a path traversal issue within the template redirect() function. An attacker does not need to be authenticated to exploit this issue and potentially read sensitive information stored on the server.

Recommendations Update the Hippoo Mobile App for WooCommerce plugin to a version later than 1.7.1.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13339

Affected Products

Hippoo Mobile App For Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13339 · Security Note
• https://twitter.com/VulmonFeeds/status/1998717888849391823 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/06900b4b-6607-4b25-b4bc-2e2906160421?source=cve · Note
• https://t.me/CVEtracker/39340 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3412701 · Note
• https://twitter.com/CVEnew/status/1998732750858367149 · Twitter Post
• https://twitter.com/cracbot/status/2000521274028937269 · Twitter Post
• https://t.me/cveNotify/145291 · Telegram Post