Hippoo Mobile App for WooCommerce - Broken Access Control

criticalseverity

9.8CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

Hippoo Mobile App for WooCommerce <= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

Impact

Attackers can escalate their privileges, potentially gaining unauthorized access or control over the application.

Fix

Update to the latest version.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/hippoo/readme.txt
Positive when: contains "Hippoo"
Send: GET {{BaseURL}}/?rest_route=/wc-hippoo/v1/ext/wp/v2/users/1 ; GET {{BaseURL}}/wp-json/wc-hippoo/v1/ext/wp/v2/users/1
Positive when: contains "\"slug\":" or "\"avatar_urls\":" or "\"_links\":" or "\"link\":" AND not contains "rest_forbidden" or "not allowed" AND status 200

Run it with nuclei: nuclei -id CVE-2026-49060 -u <target>

The full check

id: CVE-2026-49060

info:
  name: Hippoo Mobile App for WooCommerce - Broken Access Control
  author: theamanrawat
  severity: critical
  description: |
    Hippoo Mobile App for WooCommerce <= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
  impact: |
    Attackers can escalate their privileges, potentially gaining unauthorized access or control over the application.
  remediation: |
    Update to the latest version.
  reference:
    - https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-4-privilege-escalation-vulnerability
    - https://github.com/advisories/GHSA-mh6m-7983-2r5w
    - https://wordpress.org/plugins/hippoo/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49060
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-49060
    epss-score: 0.01839
    epss-percentile: 0.79151
    cwe-id: CWE-266
  metadata:
    verified: true
    max-request: 3
    vendor: hippoo
    product: hippoo
    framework: wordpress
    fofa-query: body="/wp-content/plugins/hippoo/"
    publicwww-query: "/wp-content/plugins/hippoo"
  tags: cve,cve2026,wordpress,broken-access-control,privilege-escalation,hippoo,woocommerce,unauth,vuln,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/hippoo/readme.txt"

    matchers:
      - type: word
        part: body
        words:
          - "Hippoo"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?rest_route=/wc-hippoo/v1/ext/wp/v2/users/1"
      - "{{BaseURL}}/wp-json/wc-hippoo/v1/ext/wp/v2/users/1"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"slug\":"
          - "\"avatar_urls\":"
          - "\"_links\":"
          - "\"link\":"
        condition: or

      - type: word
        part: body
        words:
          - "rest_forbidden"
          - "not allowed"
        negative: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from