CVE-2026-49060
published 2026-06-11CVE-2026-49060: Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
1.63%
76.0th percentile
Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation.
This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hippoo | hippoo_mobile_app_for_woocommerce | n/a – 1.9.4 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation.
ghsa_unreviewed·2026-06-12
CVE-2026-49060 [CRITICAL] CWE-266 Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation.
Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation.
This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.
VulnCheck
Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-49060 [CRITICAL] Vulnerability
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-4-privilege-escalation-vulnerability
No detection rules found.
Nuclei
Hippoo Mobile App for WooCommerce - Broken Access Control
nuclei·CVSS 9.8
CVE-2026-49060 [CRITICAL] Hippoo Mobile App for WooCommerce - Broken Access Control
Hippoo Mobile App for WooCommerce - Broken Access Control
Hippoo Mobile App for WooCommerce <= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
Template:
id: CVE-2026-49060
info:
name: Hippoo Mobile App for WooCommerce - Broken Access Control
author: theamanrawat
severity: critical
description: |
Hippoo Mobile App for WooCommerce <= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
impact: |
Attackers can escalate their privileges, potentially gaining unauthorized access or control over the application.
remediation: |
Update to t
No writeups or analysis indexed.
2026-06-11
Published
Exploited in the wild