CVE-2026-10580

Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce versions prior to 1.9.5

Description An authentication bypass exists that allows for administrator account takeover. The issue stems from a logic conflation in the get user permissions() function within HippooPermissions, which returns an identical null sentinel for both administrators and unauthenticated visitors. The has role access() function interprets this value as full administrator access, leading override extension permission callback() to assign return true as the permission callback for all WordPress and WooCommerce REST routes cloned under the '/wc-hippoo/v1/ext/' endpoint by re register external routes(). Additionally, the block unauthorized access() pre-dispatch guard fails to block unauthenticated users due to the same logic error. This allows unauthenticated attackers to invoke core REST endpoints without credentials, specifically by sending a POST request to '/wc-hippoo/v1/ext/wp/v2/users/' with a password variable in the request body to reset the password of any user, including the site administrator.

Recommendations Update to a version later than 1.9.4.