Hippoo Mobile App CVE-2025-13339
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Hippoo plugin
-
DeliverySend crafted request to template_redirect() with ../ sequences
-
ExploitBypass path restriction to reference arbitrary file
-
ExecutionServer returns file contents
-
ImpactHarvest wp-config.php credentials and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site running the Hippoo Mobile App for WooCommerce plugin version 1.7.1 or earlier. The only prerequisite is that the vulnerable plugin is installed and active; the flaw is reachable via the plugin's template_redirect() hook with no authentication, no user interaction, and no non-default setting required. Limiting factors are narrow: exploitation depends solely on the presence of this specific plugin (a companion for the third-party Hippoo mobile app), and impact is bounded to reading files the web-server user can access (no write or code execution). |
| Impact | This is a genuine priority despite a moderate 7.5 CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes remote, low-complexity, unauthenticated exploitation with no user interaction - the ideal profile for opportunistic mass scanning of WordPress sites. The confidentiality-only impact (C:H, I:N, A:N) correctly reflects an arbitrary file-read primitive rather than code execution. The EPSS score of 2.21% (82nd percentile) is elevated for a freshly disclosed flaw, consistent with WordPress plugin path-traversal bugs being widely and quickly scanned. No SSVC decision block was supplied in the input, so exploitation-status/automatable/technical-impact cannot be quoted from that framework. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed active exploitation - but the unauthenticated file-read primitive is trivially automatable against a known plugin path and should be treated as high-urgency for any site running the plugin. Signals are consistent (no conflicts): the CVSS vector matches the description of remote unauthenticated file read. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request that reaches the plugin's template_redirect() handler with a traversal sequence in a file parameter, causing the plugin to read and return a file outside the intended directory (for example wp-config.php, exposing database credentials and WordPress secret keys). No exploit code is publicly identified at time of analysis, but the technique requires no authentication or user interaction and is easily scriptable against any site running the plugin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated path traversal in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions up to and including 1.7.1) lets remote attackers read arbitrary files from the web server by abusing the plugin's template_redirect() handler, exposing wp-config.php database credentials, API keys, and other sensitive data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote, unauthenticated exploitation with high confidentiality impact but no integrity or availability effect, and the only prerequisite is that the plugin is installed and active on a default WordPress configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though the EPSS score of 2.21% (82nd percentile) indicates a non-trivial and above-average likelihood of exploitation activity in the near term.
RemediationAI
Apply the upstream fix by updating the Hippoo Mobile App for WooCommerce plugin to the revision produced by Trac changeset 3412701 or any later release; note that the available intelligence points to an upstream code commit in the WordPress.org plugin repository rather than a separately published tagged version, so the released patched version is not independently confirmed and administrators should verify the installed version after updating. If updating is not immediately possible, the lowest-risk compensating control is to deactivate and, if unused, delete the plugin entirely - the trade-off being that this disables the Hippoo mobile app integration for the store. As a temporary measure, a web application firewall or reverse-proxy rule that rejects requests containing path-traversal sequences (../ or encoded equivalents) on front-end requests, or that blocks requests targeting the plugin's mobile-app endpoint, reduces exposure, but such filters must be tuned to avoid blocking legitimate store traffic and can be bypassed with encoding tricks. Additional hardening that limits blast radius rather than fixing the flaw includes running PHP under a web-server user restricted to the WordPress directory (so wp-config.php and system files outside the docroot are unreadable) and applying WordPress file-permission guidance; these carry the trade-off of potential compatibility issues with other plugins that expect broader file access. Because exploitation requires no authentication or user interaction, exposure should be treated as urgent, especially given the high 82nd-percentile EPSS score; reference the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/06900b4b-6607-4b25-b4bc-2e2906160421?source=cve) and the Trac changeset (https://plugins.trac.wordpress.org/changeset/3412701/) for verification.
Affected ProductsAI
The Hippoo Mobile App for WooCommerce plugin for WordPress, all versions up to and including 1.7.1, is affected; no CPE identifiers were provided in the source data, so scoping should be done by plugin slug and installed version rather than by a CPE match. Any WordPress site - including default installations with no special configuration - that has this plugin installed and active is exposed, with the caveat that exploitation is bounded to reading files accessible to the web-server user. The vulnerability is documented by Wordfence (advisory 06900b4b-6607-4b25-b4bc-2e2906160421) and the corresponding code change is visible in the WordPress.org plugin repository Trac changeset 3412701, which should be consulted to confirm the exact fixed revision.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-22 path traversal in a WordPress plugin. The Hippoo Mobile App for WooCommerce plugin - a companion integration that exposes WooCommerce store data to the third-party Hippoo mobile application - registers a handler on the WordPress template_redirect() hook, which fires early in the request lifecycle, after WordPress initializes but before a template file is selected and rendered. Because that hook runs for unauthenticated front-end requests and the plugin does not adequately normalize or constrain user-supplied path input (for example, sequences such as ../), an attacker can supply traversal sequences that resolve outside the intended plugin or theme directory, causing the server to read files within the permissions of the web-server user. The vulnerability class allows read access only; there is no write primitive or code-execution path in the assessed vector, and the scope is unchanged (S:U), meaning the impact is contained to the vulnerable component and the files the PHP process can access. No CPE strings were supplied with the source data, so affected-product identification rests on the plugin slug and the version range stated in the advisory.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote file read over HTTP with no interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality from arbitrary file disclosure, no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Executive ViewAI
The Hippoo Mobile App for WooCommerce WordPress plugin (versions through 1.7.1) contains an unauthenticated path traversal flaw that allows any remote attacker to read arbitrary files from the web server, including wp-config.php - which typically holds database credentials and API keys. Because no vendor patch exists yet and the plugin is commonly deployed on internet-facing WooCommerce storefronts, any organization running it should treat its database and third-party credentials as potentially exposed, making this a priority for e-commerce and web operations leadership rather than a routine plugin update. Confirmed exploitation has not been reported, but the elevated EPSS score signals meaningful near-term risk.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the vulnerable plugin (all versions up to and including 1.7.1) from internet-facing sites; deploy WAF or reverse-proxy virtual patching to block path traversal patterns targeting the plugin's template_redirect() handler; restrict web server file read permissions and block direct retrieval of wp-config.php; rotate database credentials, WordPress salts/keys, and third-party API keys that may have been exposed; and enable detailed logging and alerting for anomalous file-access requests until a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB