PT-2026-47026 · Hippooo · Hippoo Mobile App For Woocommerce

Nguyen Hung

·

Published

2026-06-05

·

Updated

2026-06-05

·

CVE-2026-10580

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get user permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has role access() unconditionally interprets as full administrator access — causing override extension permission callback() to assign return true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re register external routes(), while the block unauthorized access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/ with a {"password":""} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-10580

Affected Products

Hippoo Mobile App For Woocommerce