EUVD-2026-36872
GHSA-592f-74mm-m922
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable WordPress plugin endpoint with missing authorization (PR:N, AC:L); high confidentiality exposure, limited integrity impact, no availability effect per description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.
AnalysisAI
Unauthenticated broken access control in the Hippoo Mobile App for WooCommerce WordPress plugin (versions 1.9.5 and earlier) allows remote attackers to access protected functionality or data without valid credentials. The flaw is reported by Patchstack and stems from missing authorization checks (CWE-862), enabling unauthenticated retrieval or manipulation of resources that should be gated behind authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of the Hippoo Mobile App for WooCommerce plugin at versions ≤ 1.9.5 (CVSS AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a real but bounded risk: the CVSS 3.1 base score of 8.2 reflects network-reachable, unauthenticated, low-complexity exploitation against confidentiality, which is the worst-case combination for prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker enumerates WordPress sites running the Hippoo Mobile App for WooCommerce plugin via wp-content/plugins fingerprints, then issues unauthenticated HTTP requests directly to the plugin's mobile-app REST or admin-ajax endpoints. Because the endpoints fail to verify authorization, the attacker retrieves protected WooCommerce data - for example customer order details or account information - without ever logging in. … |
| Remediation | No vendor-released patch identified at time of analysis from the supplied data; administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-5-broken-access-control-vulnerability for a fixed version above 1.9.5 and upgrade as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit all WordPress instances for Hippoo Mobile App v1.9.5 or earlier deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today