Hippoo Mobile App CVE-2026-111601

Exploitation requires that an unauthenticated attacker lure a victim into clicking a crafted URL (UI:R is the primary limiting factor) that targets the plugin's REST endpoint with a malicious 'token_id' query parameter. The specific technical precondition is the plugin's own REST routing: the URL-path regex restricts the path segment to word characters, but WP_REST_Request query-string precedence lets a ?token_id= value override the path and reach the vulnerable handler (rest.php ~L189/L422/L424) verbatim, so no non-default server configuration is needed - the vulnerable code path is reachable on standard installs of Hippoo Mobile App for WooCommerce ≤1.12.0. Impact is limited to reflected (non-persistent) script execution in the victim's browser; it does not auto-trigger and affects only users who are induced to click.

Signals are mostly consistent and point to a genuine but moderate-severity issue rather than a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) describes a classic reflected XSS: network-reachable, low complexity, no privileges, but requiring user interaction (victim must click a crafted link), with changed scope and limited confidentiality/integrity impact and no availability impact. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC/exploit code is referenced, so there is no public exploit identified at time of analysis. The description adds valuable technical nuance confirmed against the Wordfence advisory and the plugin source on plugins.trac.wordpress.org: the REST route's URL-path regex only constrains the path segment to word characters, but WP_REST_Request's query-string precedence lets a ?token_id= value override the path and reach the handler verbatim, defeating the intended regex sanitization. This is a credible, well-understood bug class for WordPress plugins. Net: a real, patch-worthy issue, but the UI:R requirement and limited (reflected, not stored/persistent) impact keep real-world risk moderate; prioritize patching, but this is not a wormable or unauthenticated-RCE-class crisis.

An attacker crafts a malicious URL targeting a vulnerable site's Hippoo REST endpoint with a JavaScript payload in the token_id query parameter, which bypasses the path regex and is reflected unsanitized into the response. The attacker emails or messages the link to a logged-in administrator or customer; when the victim clicks it, the script executes in their browser session in the site's origin, enabling session/cookie theft or actions on their behalf. No authentication is required of the attacker, but the attack fails unless a victim is successfully tricked into clicking (UI:R); no public exploit code is referenced.