CVE-2026-10580: Hippoo Mobile App Auth Bypass Vulnerability

CVE-2026-10580 Overview

CVE-2026-10580 is an authentication bypass vulnerability in the Hippoo Mobile App for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.9.4. The plugin's permission logic conflates administrators with unauthenticated visitors, granting full administrator access to any unauthenticated request reaching cloned REST routes under /wc-hippoo/v1/ext/. An attacker can invoke any core WordPress or WooCommerce REST endpoint without credentials, including resetting the administrator password, resulting in full site takeover. The issue is categorized under [CWE-285: Improper Authorization].

Critical Impact
Unauthenticated attackers can reset the password of any WordPress user — including the site administrator — and gain complete administrative control of affected sites.

Affected Products

Hippoo Mobile App for WooCommerce plugin for WordPress
All versions up to and including 1.9.4
WordPress sites running WooCommerce with the Hippoo plugin enabled

Discovery Timeline

2026-06-05 - CVE-2026-10580 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-10580

Vulnerability Analysis

The vulnerability resides in the plugin's REST API permission handling. The HippooPermissions::get_user_permissions() function returns the same null sentinel value for both administrators and unauthenticated visitors. The downstream HippooPermissions::has_role_access() function unconditionally interprets that null value as full administrator access.

As a result, override_extension_permission_callback() assigns __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(). The pre-dispatch guard in block_unauthorized_access() shares the same flawed logic and fails to reject anonymous callers.

This transforms the plugin into an unauthenticated proxy to every core REST endpoint. An attacker can send a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a JSON body containing a new password value to overwrite credentials for any user, including the administrator account.

Root Cause

The root cause is a logic conflation in the permission resolution code. Returning the same sentinel value for two distinct authorization states — privileged administrator and unauthenticated visitor — collapses the access control decision into a single permissive branch. The downstream check treats absence of evidence as evidence of authorization.

Attack Vector

Exploitation requires only network access to the target WordPress site. No authentication, user interaction, or prior knowledge of valid credentials is needed. An attacker enumerates user IDs through cloned REST routes, then issues a POST request to the cloned wp/v2/users/<id> endpoint with a JSON body of {"password":"<new_password>"}. The plugin executes the request as if the caller were an administrator, overwriting the target account's password. The attacker then authenticates to /wp-admin with the new credentials.

// Exploitation pattern (described in prose — no verified PoC code published)
// 1. Attacker sends an unauthenticated POST to:
//    /wc-hippoo/v1/ext/wp/v2/users/1
// 2. Request body:
//    {"password":"<attacker_controlled_value>"}
// 3. Plugin routes the request through __return_true permission callback
// 4. WordPress core updates the administrator password
// See Wordfence advisory for full technical details.

Detection Methods for CVE-2026-10580

Indicators of Compromise

HTTP requests to any URI beginning with /wc-hippoo/v1/ext/ originating from unauthenticated sources
POST requests to /wc-hippoo/v1/ext/wp/v2/users/<id> containing a password JSON field
Unexpected password change events for administrator accounts in the WordPress user metadata table
New administrator logins from previously unseen IP addresses or user agents following REST API traffic

Detection Strategies

Review web server access logs for any request paths matching /wc-hippoo/v1/ext/wp/v2/users/ or /wc-hippoo/v1/ext/wc/
Correlate REST API requests with subsequent administrator authentication events
Compare the user_pass hash modification timestamps in wp_users against expected password rotation activity
Inspect the WordPress audit log for plugin, theme, or option changes performed shortly after suspicious REST traffic

Monitoring Recommendations

Forward WordPress access logs and application logs to a centralized analytics platform for rule-based alerting
Alert on any POST to cloned Hippoo REST endpoints from non-allowlisted IP addresses
Monitor for administrator account creation, role escalation, and password reset events occurring without a corresponding authenticated session

How to Mitigate CVE-2026-10580

Immediate Actions Required

Update the Hippoo Mobile App for WooCommerce plugin to a version higher than 1.9.4 as soon as the vendor publishes a fixed release
If no fixed version is yet available, deactivate and remove the plugin from all WordPress installations
Rotate all administrator passwords and revoke active sessions across affected sites
Audit installed plugins, themes, users, and scheduled tasks for unauthorized modifications

Patch Information

A changeset addressing the vulnerability is referenced in the WordPress plugin repository. Review the WordPress Hippoo Changeset and the Wordfence Vulnerability Report for the authoritative remediation guidance. Apply the latest plugin update through the WordPress admin interface or via WP-CLI once published.

Workarounds

Block all external requests to URIs beginning with /wc-hippoo/v1/ext/ at the web application firewall or reverse proxy
Restrict access to the WordPress REST API to authenticated sessions where the plugin is not required for public functionality
Disable the Hippoo plugin until the patched version is verified in a staging environment

bash

# Example nginx block to reject unauthenticated access to the vulnerable route prefix
location ~ ^/wc-hippoo/v1/ext/ {
    return 403;
}

# Or via WP-CLI, deactivate the plugin until patched
wp plugin deactivate hippoo --all