What is the CVSS score of CVE-2026-10580?

CVE-2026-10580 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Hippoo Mobile App for WooCommerce are affected by CVE-2026-10580?

The Hippoo Mobile App for WooCommerce plugin (versions ≤ 1.9.4) contains a critical authentication bypass that enables unauthenticated attackers to reset WordPress administrator passwords and achieve…

Is there a public PoC exploit available for CVE-2026-10580?

Yes, a public proof-of-concept exploit is available for CVE-2026-10580. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-10580?

Within 24 hours: Disable the Hippoo Mobile App for WooCommerce plugin on all systems running versions ≤ 1.9.4, or implement WAF/firewall rules to block REST API access to the vulnerable endpoints. Within 7 days: Review WordPress audit logs and user account change history for exploitation indicators; reset all administrator credentials as a precaution. Within 30 days: Monitor vendor security advisories for a patch release; if unavailable, evaluate permanent plugin removal or replacement with secure alternatives.

Hippoo Mobile App for WooCommerce CVE-2026-10580

EUVD-2026-34887 CRITICAL

Improper Authorization (CWE-285)

2026-06-05 Wordfence

GHSA-5xvj-rcr9-wm4h

WordPress Authentication Bypass Wordpress Plugin Hippoo Mobile App For Woocommerce

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:23 vuln.today

CVE Published

Jun 05, 2026 - 18:31 nvd

CRITICAL 9.8

DescriptionCVE.org

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors - a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access - causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials - most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.

Articles & Coverage 1

POC CVE-2026-10580: Hippoo WooCommerce Plugin Auth Bypass Enables Unauthenticated Admin Takeover Jun 06, 2026

AnalysisAI

Unauthenticated administrator account takeover in the Hippoo Mobile App for WooCommerce WordPress plugin (versions ≤ 1.9.4) allows remote attackers to reset any user's password - including the site administrator's - by sending a single crafted POST request to a cloned REST route. The root cause is a logic conflation in HippooPermissions::get_user_permissions() that returns the same null sentinel for both administrators and anonymous visitors, which is then interpreted as full admin access. No public exploit identified at time of analysis, but the trivial exploitation path and 9.8 CVSS score make this an urgent patch priority for any WordPress site running the plugin.

Technical ContextAI

The vulnerability lives in a WordPress plugin that proxies WordPress and WooCommerce core REST API routes under a /wc-hippoo/v1/ext/ namespace for use by a companion mobile app. The plugin's HippooControllerWithAuth::re_register_external_routes() clones every core REST route, and override_extension_permission_callback() decides which permission callback to bind. Because HippooPermissions::get_user_permissions() uses a single null sentinel to represent both 'administrator' and 'no user logged in,' the downstream check has_role_access() treats unauthenticated requests as administrative, and the block_unauthorized_access() pre-dispatch guard fails open for the same reason. The result is that __return_true becomes the permission callback for every cloned route. The CWE-285 (Improper Authorization) classification fits precisely - authorization logic exists but is fundamentally broken by ambiguous return semantics.

RemediationAI

Upstream fix available (commit/changeset 3557733 at https://plugins.trac.wordpress.org/changeset/3557733/hippoo); a released patched version above 1.9.4 is not independently confirmed in the supplied data, so administrators should update to the latest available release in the WordPress plugin directory and verify the installed version is greater than 1.9.4. If immediate patching is not possible, the most effective compensating control is to deactivate and remove the Hippoo plugin entirely, which will break the companion mobile app but eliminates the entire /wc-hippoo/v1/ext/ namespace. As an interim WAF-layer mitigation, block all external requests to URIs matching /wp-json/wc-hippoo/v1/ext/ (and the equivalent ?rest_route= query form), accepting that this will disable mobile-app functionality. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/73835cfc-4c10-40d5-8df2-903d907326d4?source=cve for detection signatures.