CVE-2025-12655
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to and including 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Risk Assessment
Arbitrary file write could allow an attacker to place malicious content on the server, potentially leading to defacement, script injection, or site takeover.
Recommendation
Update the Hippoo Mobile App plugin to the latest version. Additionally, review and secure the REST API endpoint to require authorization.
Other vulnerabilities in Hippoo Mobile App for WooCommerce
See all- CVE-2026-108483High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce (hippoo) allows Reflected XSS. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
- CVE-2026-49065High
The Hippoo mobile app for WooCommerce versions up to 1.9.5 has an issue with unauthenticated access that may lead to broken access control.
Original NVD description (English source)
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS