/Vulnerability Library

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

CVE-2026-10580
Verified

Description

Hippoo Mobile App for WooCommerce WordPress plugin <= 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset.

Severity

Critical

CVSS Score

9.8

Exploit Probability

3%

Affected Product

hippoo-mobile-app-for-woocommerce

Published Date

June 10, 2026

Template Author

pussycat0x

CVE-2026-10580.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-10580
CWE ID:
cwe-285

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hippoo/hippoo-mobile-app-for-woocommerce-194-unauthenticated-authentication-bypass-to-administrator-account-takeover-via-rest-apihttps://plugins.trac.wordpress.org/changeset/3557733

Remediation Steps

Update to a version later than 1.9.4 or the latest available version.