EUVD-2026-36872
GHSA-592f-74mm-m922
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site running Hippoo plugin
-
DeliveryIdentify exposed mobile-app endpoint
-
ExploitSend unauthenticated HTTP request
-
ExecutionBypass missing authorization check
-
ImpactExfiltrate protected WooCommerce data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Hippoo Mobile App for WooCommerce plugin at versions ≤ 1.9.5 (CVSS AV:N/AC:L/PR:N/UI:N). Exploitation is limited to sites that actually have this specific plugin installed and activated on a publicly reachable WordPress/WooCommerce instance; targets without the plugin or with the plugin's REST/AJAX endpoints blocked at the perimeter are not exposed. Impact is bounded by the plugin's data surface - the CVSS C:H/I:L/A:N profile suggests confidentiality of WooCommerce data is the primary risk rather than full site takeover. |
| Impact | Signals point to a real but bounded risk: the CVSS 3.1 base score of 8.2 reflects network-reachable, unauthenticated, low-complexity exploitation against confidentiality, which is the worst-case combination for prioritization. However, no EPSS score, KEV listing, SSVC decision, or public POC was supplied in the input, so there is no evidence of widespread automated exploitation yet. The plugin's likely installation footprint is smaller than mainstream WooCommerce extensions, which historically means slower mass-exploitation but is not a substitute for patching - Patchstack-tracked WordPress access-control bugs are routinely weaponized once a fix surfaces. Net assessment: treat as high priority for any site running the plugin, but the absence of KEV/EPSS data means urgency should be calibrated to exposure rather than assumed in-the-wild activity. |
| Exploit ScenarioDerived | A remote attacker enumerates WordPress sites running the Hippoo Mobile App for WooCommerce plugin via wp-content/plugins fingerprints, then issues unauthenticated HTTP requests directly to the plugin's mobile-app REST or admin-ajax endpoints. Because the endpoints fail to verify authorization, the attacker retrieves protected WooCommerce data - for example customer order details or account information - without ever logging in. No public exploit identified at time of analysis, but the missing-authorization pattern is trivially scriptable once endpoint paths are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated broken access control in the Hippoo Mobile App for WooCommerce WordPress plugin (versions 1.9.5 and earlier) allows remote attackers to access protected functionality or data without valid credentials. The flaw is reported by Patchstack and stems from missing authorization checks (CWE-862), enabling unauthenticated retrieval or manipulation of resources that should be gated behind authentication. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data; administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-5-broken-access-control-vulnerability for a fixed version above 1.9.5 and upgrade as soon as it is published. Until a patch is available, consider deactivating and removing the Hippoo Mobile App for WooCommerce plugin (side effect: the companion mobile app will stop working against the store), or use a WordPress WAF such as Patchstack/Wordfence with a virtual patch for this CVE, or restrict access to the plugin's REST/AJAX endpoints (typically under /wp-json/ or admin-ajax.php actions prefixed with the plugin's slug) by IP allowlist at the reverse proxy - accepting that legitimate mobile clients on dynamic IPs will be blocked.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hippoo Mobile App for WooCommerce is a WordPress plugin (CPE cpe:2.3:a:hippooo:hippoo_mobile_app_for_woocommerce) that bridges a WooCommerce storefront with a companion mobile application, typically by exposing REST or AJAX endpoints used by the mobile client. CWE-862 (Missing Authorization) means that one or more of these endpoints performs sensitive actions or returns sensitive data without verifying that the requester is permitted - a recurring pattern in WordPress plugins that rely on action hooks without calling current_user_can() or a proper capability/nonce check. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the affected endpoint is reachable over the network with no authentication, and the C:H/I:L/A:N impact profile suggests significant data exposure with limited write impact.
Know when Hippoo Mobile App For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable WordPress plugin endpoint with missing authorization (PR:N, AC:L); high confidentiality exposure, limited integrity impact, no availability effect per description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.
Executive ViewAI
The Hippoo Mobile App for WooCommerce plugin (versions 1.9.5 and earlier) contains an unauthenticated broken access control vulnerability that allows attackers to bypass authentication and access protected customer data and business functionality. Organizations using this plugin face immediate risk of unauthorized data exposure and potential fraudulent activity without compensating controls in place. This vulnerability affects WooCommerce merchants across all deployment sizes.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable the Hippoo Mobile App plugin; (2) Implement network-level access restrictions via WAF or IP allowlisting to plugin endpoints; (3) Deploy continuous monitoring and alerting for unauthorized access attempts to protected resources; (4) Evaluate alternative WooCommerce mobile solutions from actively maintained vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated administrator account takeover in the Hippoo Mobile App for WooCommerce WordPress plugin (versions ≤ 1.9
Privilege escalation in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to and including 1.9.4) allo
Reflected cross-site scripting in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions through 1.12.0) l
Exploit-DB