What is the CVSS score of CVE-2025-12655?

CVE-2025-12655 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Hippoo WooCommerce Plugin CVE-2025-12655

MEDIUM

Missing Authorization (CWE-862)

2025-12-12 security@wordfence.com

WordPress Authentication Bypass Woocommerce Wordpress Plugin

5.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Endpoint is remotely reachable and permission_callback '__return_true' makes it unauthenticated (AV:N/AC:L/PR:N/UI:N); impact is integrity-only (I:L) since only non-executable JSON is written, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 22:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 07, 2026 - 21:47 vuln.today

CVE Published

Dec 12, 2025 - 07:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/save_callback/{token_id} being registered with permission_callback => '__return_true', which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.

AnalysisAI

Unauthenticated remote attackers can write arbitrary JSON files into a WordPress site's publicly accessible uploads directory through the Hippoo Mobile App for WooCommerce plugin, in all versions up to and including 1.7.1. The flaw is a missing authorization check: the REST route /wp-json/hippoo/v1/wc/token/save_callback/{token_id} is registered with permission_callback => '__return_true', so no authentication is required and exploitation works against default configurations whenever the plugin is installed and active. Impact is integrity-only (C:N/I:L/A:N, CVSS 5.3) because the write primitive is limited to JSON content rather than executable code, so there is no direct remote code execution; EPSS is low at 0.28% (19th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.

Technical ContextAI

The Hippoo Mobile App for WooCommerce plugin extends WordPress's REST API by registering custom routes under the /wp-json/hippoo/v1/ namespace, implemented in app/web_api.php (route registration referenced at lines 45 and 117 of the 1.6.1 tag). WordPress's register_rest_route() accepts a permission_callback argument that governs whether a request is authorized; setting it to the built-in '__return_true' callback unconditionally authorizes every request, effectively disabling the framework's authentication and capability checks for that route. The route's handler processes the caller-supplied {token_id} path parameter and persists JSON data supplied in the request into the site's wp-content/uploads directory, which is web-accessible by design. This maps to CWE-862 (Missing Authorization): the root cause is not a memory-safety bug or injection flaw but the absence of any check that the requester is authenticated or holds a required capability. Because no PHP or other executable content is written, the attack surface is confined to data files that could only become dangerous if the application later trusts and consumes them, or if they are chained with a separate vulnerability.

Affected ProductsAI

The Hippoo Mobile App for WooCommerce plugin for WordPress, all versions up to and including 1.7.1, is affected; the vulnerable code path is visible in the plugin's 1.6.1 tag in app/web_api.php and app/utils.php, meaning earlier 1.x releases share the same missing permission check on the /wp-json/hippoo/v1/wc/token/save_callback/{token_id} route. Any WordPress site with this plugin installed and active is exposed regardless of core or PHP version, since the defect resides entirely in the plugin. No CPE identifiers were supplied in the available intelligence; the authoritative vendor-sourced writeup is the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d34701a0-c745-441c-8d6c-7befc877f8d0?source=cve, with the underlying code references at https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L45, https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L117, and https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/utils.php#L1.

RemediationAI

No vendor-released patch was identified at time of analysis (no fixed version number appears in the available data), so the primary action is to check the Hippoo plugin's current release and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d34701a0-c745-441c-8d6c-7befc877f8d0?source=cve for an updated tag, and to deactivate and delete the plugin if it is not actively required - this fully removes the exposure but disables the mobile-app integration. If the plugin must stay online, block the vulnerable route at the edge or web server: in nginx add a location rule returning 403 for /wp-json/hippoo/v1/wc/token/save_callback/, and in Apache use a Require all denied directive for that path, which neutralizes unauthenticated writes but breaks the mobile token-save workflow until properly authorized. Additional compensating controls include restricting network access to /wp-json/hippoo/ to trusted mobile-app IP ranges, tightening uploads-directory file permissions to prevent PHP execution, and monitoring wp-content/uploads for unexpected JSON files created outside normal application activity. Note that because only JSON content is written and there is no direct code execution path, these measures are proportionate to a moderate-priority integrity issue.