VulnSocial

CVE-2026-10580Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-285

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 3d ago at 2 mentions (2026-06-06); latest day: 1
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-06-06: 2Mentions · 2026-06-07: 1Mentions · 2026-06-11: 1Mentions · 2026-06-15: 1PoC Mentioned / Linked · 2026-06-15: 1Patch / Workaround · 2026-06-07: 1Technical Details · 2026-06-06: 2Technical Details · 2026-06-07: 1Technical Details · 2026-06-11: 1Technical Details · 2026-06-15: 106-0606-0706-1106-15
Signal classification3 categories
Disclosure
360.0%
General
120.0%
PoC
120.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-062
Disclosure2
2026-06-071
Disclosure1
2026-06-111
General1
2026-06-151
PoC1
Full discourse5 posts
  • pdnuclei-bot@pdnuclei_bot
    General

    🚨 CVE-2026-10580 - critical 🚨 Hippoo Mobile App for WooCommerce &lt;= 1.9.4 - Authentication Bypass to Admin Account Takeover &gt; Hippoo Mobile App for WooCommerce WordPress plugin &lt;= 1.9.4 contains an authenticatio... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-10580 ...

    Post summary

    The post informs about a critical authentication bypass in Hippoo Mobile App for WooCommerce, providing only high‑level details and a link for more information, without any PoC, exploit code, patch, or exploitation evidence.

    0002292
    958 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-10580 The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and … https://www.cve.org/CVERecord?id=CVE-2026-10580

    Post summary

    The text announces that the Hippoo Mobile App for WooCommerce plugin is vulnerable to an authentication bypass that could allow an attacker to take over an administrator account in all versions up to the mentioned release.

    00010180
    57.6K followersView on X
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-10580-hippoo-version-1-9-4-critical-vulnerability-proof-of-concept CVE-2026-10580 hippoo (CVSS Score 9.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecur…

    Post summary

    A proof‑of‑concept has been released for the CVE‑2026‑10580 critical vulnerability in Hippoo WordPress plugin (v1.9.4), but there is no mention of active exploitation or a patch.

    0000055
    9 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-10580 - Critical Authentication Bypass in Hippoo WordPress plugin. Flaw conflates admin and unauthenticated user permissions, allowing full admin takeover. CVSS 9.8. No patch available. Disable plugin now. #CVE #WordPress #infosecurity More Free info. https://www.valtersit.com/cve/CVE-2026-10580/

    Post summary

    CVE-2026-10580 is a critical authentication bypass in the Hippoo WordPress plugin, scoring 9.8 on CVSS, with no patch available; disabling the plugin is the recommended mitigation.

    0000032
    919 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-10580 The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and … https://www.cve.org/CVERecord?id=CVE-2026-10580 ----- Traducción: CVE-2026-10580 El … http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑10580, an authentication bypass in the Hippoo Mobile App for WooCommerce that can lead to admin takeover, without providing a PoC, exploit, or patch details.

    0000039
    79 followersView on X

Explore more

Back to dashboard