Hippooo Hippoo Mobile App For Woocommerce vulnerabilities

CVE-2026-10580 [CRITICAL] CWE-285 CVE-2026-10580: The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass le The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visit

CVE-2025-13339 [HIGH] CWE-22 CVE-2025-13339: The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all ve The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVE-2026-49065 [HIGH] CWE-862 CVE-2026-49065: Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions. Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.

CVE-2025-12655 [MEDIUM] CWE-862 CVE-2025-12655: The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauth