What is the CVSS score of CVE-2026-49065?

CVE-2026-49065 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Hippoo Mobile App for WooCommerce are affected by CVE-2026-49065?

The Hippoo Mobile App for WooCommerce plugin (versions 1.9.5 and earlier) contains an unauthenticated broken access control vulnerability that allows attackers to bypass authentication and access…

How to fix or mitigate CVE-2026-49065?

24 hours: Audit all WordPress instances for Hippoo Mobile App v1.9.5 or earlier deployment. 7 days: Implement interim controls-disable or deactivate the plugin, configure Web Application Firewall rules to block unauthenticated plugin endpoints, and enable comprehensive access logging on WooCommerce administrative and API routes. 30 days: Monitor Patchstack security advisories and vendor communications for patch release; evaluate plugin replacement or alternative vendor solutions if patch is not made available within 30 days.

Hippoo Mobile App for WooCommerce CVE-2026-49065

EUVD-2026-36872 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-592f-74mm-m922

WordPress Authentication Bypass Wordpress Plugin Hippoo Mobile App For Woocommerce

8.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable WordPress plugin endpoint with missing authorization (PR:N, AC:L); high confidentiality exposure, limited integrity impact, no availability effect per description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:39 vuln.today

CVE Published

Jun 15, 2026 - 20:19 cve.org

HIGH 8.2

DescriptionCVE.org

Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.

AnalysisAI

Unauthenticated broken access control in the Hippoo Mobile App for WooCommerce WordPress plugin (versions 1.9.5 and earlier) allows remote attackers to access protected functionality or data without valid credentials. The flaw is reported by Patchstack and stems from missing authorization checks (CWE-862), enabling unauthenticated retrieval or manipulation of resources that should be gated behind authentication. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

Hippoo Mobile App for WooCommerce is a WordPress plugin (CPE cpe:2.3:a:hippooo:hippoo_mobile_app_for_woocommerce) that bridges a WooCommerce storefront with a companion mobile application, typically by exposing REST or AJAX endpoints used by the mobile client. CWE-862 (Missing Authorization) means that one or more of these endpoints performs sensitive actions or returns sensitive data without verifying that the requester is permitted - a recurring pattern in WordPress plugins that rely on action hooks without calling current_user_can() or a proper capability/nonce check. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the affected endpoint is reachable over the network with no authentication, and the C:H/I:L/A:N impact profile suggests significant data exposure with limited write impact.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-5-broken-access-control-vulnerability for a fixed version above 1.9.5 and upgrade as soon as it is published. Until a patch is available, consider deactivating and removing the Hippoo Mobile App for WooCommerce plugin (side effect: the companion mobile app will stop working against the store), or use a WordPress WAF such as Patchstack/Wordfence with a virtual patch for this CVE, or restrict access to the plugin's REST/AJAX endpoints (typically under /wp-json/ or admin-ajax.php actions prefixed with the plugin's slug) by IP allowlist at the reverse proxy - accepting that legitimate mobile clients on dynamic IPs will be blocked.