EUVD-2026-34887
GHSA-5xvj-rcr9-wm4h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running Hippoo plugin
-
DeliveryEnumerate /wp-json/wc-hippoo/v1/ext/ namespace
-
ExploitSend unauthenticated POST to /ext/wp/v2/users/1 with new password
-
InstallPermission callback __return_true accepts request
-
C2Administrator password reset
-
ExecuteLog in to wp-admin as administrator
-
ImpactInstall malicious plugin for persistent RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the Hippoo Mobile App for WooCommerce plugin (versions ≤ 1.9.4) be installed and active on a network-reachable WordPress site - the vulnerable /wc-hippoo/v1/ext/ REST namespace is registered unconditionally by the plugin's bootstrap, so no special plugin configuration, premium tier, or mobile-app pairing is needed. No authentication, no user interaction, and no prior knowledge of credentials are required; the attacker only needs to know or guess a target user ID (the administrator is conventionally ID 1). The only meaningful limit is that the WordPress site must expose its REST API to the attacker's network position, which is the default for public WordPress installations. |
| Impact | All available signals point to high real-world risk. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects an unauthenticated, network-reachable, no-user-interaction path to full admin takeover, and the description provides an exact one-shot exploit recipe (POST to /wc-hippoo/v1/ext/wp/v2/users/<id> with a new password). EPSS and CISA KEV data were not provided in the input, so active exploitation status is unconfirmed at this time, but discovery by Wordfence - who routinely publishes detection signatures - means WordPress firewall vendors will likely begin observing scanning quickly. Given that WordPress plugin authentication-bypass bugs are heavily targeted by mass-scanning botnets, the practical risk is high regardless of current EPSS, and any site running the plugin should treat this as an emergency patch. |
| Exploit ScenarioDerived | An attacker scans the internet for WordPress sites exposing /wp-json/wc-hippoo/v1/ext/, identifies user ID 1 (typically the original administrator), and sends a single unauthenticated POST request to /wp-json/wc-hippoo/v1/ext/wp/v2/users/1 with a JSON body of {"password":"attacker-chosen"}. The server accepts the request because the cloned route's permission callback is __return_true, resets the administrator's password, and the attacker logs into /wp-admin with full site control - typically followed by uploading a malicious plugin or theme for persistent backdoor access. No public exploit identified at time of analysis, but the one-request exploit primitive is fully disclosed in the CVE description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Unauthenticated administrator account takeover in the Hippoo Mobile App for WooCommerce WordPress plugin (versions ≤ 1.9.4) allows remote attackers to reset any user's password - including the site administrator's - by sending a single crafted POST request to a cloned REST route. The root cause is a logic conflation in HippooPermissions::get_user_permissions() that returns the same null sentinel for both administrators and anonymous visitors, which is then interpreted as full admin access. No public exploit identified at time of analysis, but the trivial exploitation path and 9.8 CVSS score make this an urgent patch priority for any WordPress site running the plugin.
RemediationAI
Upstream fix available (commit/changeset 3557733 at https://plugins.trac.wordpress.org/changeset/3557733/hippoo); a released patched version above 1.9.4 is not independently confirmed in the supplied data, so administrators should update to the latest available release in the WordPress plugin directory and verify the installed version is greater than 1.9.4. If immediate patching is not possible, the most effective compensating control is to deactivate and remove the Hippoo plugin entirely, which will break the companion mobile app but eliminates the entire /wc-hippoo/v1/ext/ namespace. As an interim WAF-layer mitigation, block all external requests to URIs matching /wp-json/wc-hippoo/v1/ext/ (and the equivalent ?rest_route= query form), accepting that this will disable mobile-app functionality. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/73835cfc-4c10-40d5-8df2-903d907326d4?source=cve for detection signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in a WordPress plugin that proxies WordPress and WooCommerce core REST API routes under a /wc-hippoo/v1/ext/ namespace for use by a companion mobile app. The plugin's HippooControllerWithAuth::re_register_external_routes() clones every core REST route, and override_extension_permission_callback() decides which permission callback to bind. Because HippooPermissions::get_user_permissions() uses a single null sentinel to represent both 'administrator' and 'no user logged in,' the downstream check has_role_access() treats unauthenticated requests as administrative, and the block_unauthorized_access() pre-dispatch guard fails open for the same reason. The result is that __return_true becomes the permission callback for every cloned route. The CWE-285 (Improper Authorization) classification fits precisely - authorization logic exists but is fundamentally broken by ambiguous return semantics.
Know when Hippoo Mobile App For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors - a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access - causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials - most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.
Articles & Coverage 1
Executive ViewAI
The Hippoo Mobile App for WooCommerce plugin (versions ≤ 1.9.4) contains a critical authentication bypass that enables unauthenticated attackers to reset WordPress administrator passwords and achieve complete site takeover through a single API request. Any organization running this plugin faces immediate exposure to account compromise without any user interaction or valid credentials required.
Disable the plugin immediately. If operations require the plugin to remain active: (1) restrict REST API endpoints via Web Application Firewall to explicitly trusted IP addresses only, (2) enforce multi-factor authentication on all WordPress administrator accounts, (3) implement real-time alerting on password changes and privileged account modifications, (4) maintain detailed logging of all REST API requests for forensic review. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to and including 1.9.4) allo
Unauthenticated broken access control in the Hippoo Mobile App for WooCommerce WordPress plugin (versions 1.9.5 and earl
Reflected cross-site scripting in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions through 1.12.0) l
Exploit-DB