PT-2025-50890 · WordPress · Hippoo Mobile App For Woocommerce

Numex · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-12655

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce plugin for WordPress versions up to and including 1.7.1

Description The software is susceptible to unauthorized file writing due to a missing authorization check. The REST API endpoint /wp-json/hippoo/v1/wc/token/save callback/{token id} is registered with permission callback => ' return true', which permits unauthenticated access. This allows attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint. The token id is a variable within the API endpoint.

Recommendations Update the Hippoo Mobile App for WooCommerce plugin for WordPress to a version later than 1.7.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12655

Affected Products

Hippoo Mobile App For Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12655 · Security Note
• https://t.me/cveNotify/145559 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d34701a0-c745-441c-8d6c-7befc877f8d0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L117 · Note
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/utils.php#L1 · Note
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L45 · Note
• https://t.me/CVEtracker/39586 · Telegram Post