EUVD-2026-36358
GHSA-mh6m-7983-2r5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running Hippoo plugin
-
DeliverySend crafted request to plugin endpoint
-
ExploitTrigger incorrect privilege assignment
-
InstallObtain administrator-level account
-
C2Authenticate to wp-admin
-
ExecuteUpload malicious plugin or theme
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Hippoo Mobile App for WooCommerce plugin versions up through 1.9.4 on a WordPress site where the plugin is installed and active. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no non-default settings are required; the only practical limiter is that the target must have the Hippoo plugin enabled and its REST/AJAX endpoints reachable from the attacker, and the WordPress site must permit account creation or role-modification flows that the plugin exposes. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity flaw exploitable without authentication or user interaction, with high impact across confidentiality, integrity, and availability - consistent with full administrative takeover of a WordPress site. The vulnerability is not listed in CISA KEV and no public exploit identified at time of analysis, and no EPSS score was supplied, so empirical exploitation likelihood cannot be quantified from the input. Despite the absence of confirmed in-the-wild activity, WordPress/WooCommerce plugins with CWE-266 flaws are historically high-value targets for opportunistic mass-scanning, so the practical priority should remain high for any site running Hippoo Mobile App for WooCommerce, even though only a single Patchstack reference is available and no vendor advisory or patched version was disclosed in the supplied data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a plugin-exposed registration or role-assignment endpoint on a vulnerable WordPress site, supplying an elevated role value (e.g., 'administrator') that the plugin assigns without proper capability checks. The attacker then logs in to the newly created or modified account and installs a malicious plugin or theme to achieve full code execution on the storefront. No POC is referenced in the supplied data, but the AV:N/AC:L/PR:N/UI:N vector indicates trivial scriptability if such an endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Privilege escalation in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to and including 1.9.4) allows remote unauthenticated attackers to elevate privileges on affected sites due to incorrect privilege assignment (CWE-266). With a CVSS 3.1 score of 9.8 and Patchstack-reported network-exploitable characteristics, this issue can lead to full compromise of WooCommerce-backed WordPress stores; no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis in the supplied data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-4-privilege-escalation-vulnerability should be monitored for a fixed release beyond 1.9.4. Until a patched version is published, deactivate and remove the Hippoo Mobile App for WooCommerce plugin (this disables the mobile-app integration with the storefront), or use Patchstack/WAF virtual patching to block requests to the plugin's REST endpoints (which will break legitimate mobile-app traffic). Additionally restrict access to /wp-json/hippoo/* and the wp-admin/users.php area to known IPs, audit wp_users and wp_usermeta for unexpected administrator or shop_manager accounts, and rotate all admin credentials and WooCommerce API keys after confirming integrity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Hippoo Mobile App for WooCommerce plugin, which bridges a WooCommerce-powered WordPress storefront to a mobile application, typically via REST endpoints handling authentication, registration, or session/role assignment. CWE-266 (Incorrect Privilege Assignment) indicates that the plugin assigns higher privileges to a user than intended - commonly by accepting a client-supplied role parameter, failing to enforce capability checks (current_user_can), or by registering accounts with elevated WordPress roles such as administrator instead of customer. The affected CPE 'cpe:2.3:a:hippoo:hippoo_mobile_app_for_woocommerce:*' covers all releases through 1.9.4, meaning every version up to the latest at time of disclosure is vulnerable.
Know when Hippoo Mobile App For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Plugin exposes a network-reachable endpoint that incorrectly assigns elevated roles without authentication or user interaction, yielding full admin takeover and high C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation.
This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.
Articles & Coverage 2
Executive ViewAI
The Hippoo Mobile App for WooCommerce WordPress plugin (versions ≤1.9.4) contains a critical privilege escalation vulnerability (CVE-2026-49060, CVSS 9.8) allowing unauthenticated remote attackers to gain administrative access to affected WooCommerce stores, with no public exploit identified at time of analysis. This vulnerability presents immediate risk to e-commerce platforms relying on this plugin, potentially compromising customer data, payment processing, and store operations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the plugin immediately if not critical to business operations; (2) Restrict plugin functionality via Web Application Firewall (WAF) rules for unauthenticated access; (3) Implement network segmentation isolating WooCommerce administrator interfaces; (4) Enable enhanced logging and real-time alerting for privilege escalation attempts; (5) Enforce multi-factor authentication on all administrative accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated administrator account takeover in the Hippoo Mobile App for WooCommerce WordPress plugin (versions ≤ 1.9
Unauthenticated broken access control in the Hippoo Mobile App for WooCommerce WordPress plugin (versions 1.9.5 and earl
Reflected cross-site scripting in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions through 1.12.0) l
Exploit-DB