What the vulnerability does
01Description
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
The Hippoo Mobile App for WooCommerce versions 1.7.1 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data through the network. No authentication is required to exploit this vulnerability. The flaw affects the app's ability to control who can make changes to protected resources.
What an attacker can do
03Attacker Capabilities
Modify data in the app without authentication.
Potential impact on your site
04Site Impact
Unauthorized users can alter app data, potentially affecting WooCommerce store operations and data integrity.
Conditions required to exploit
05Prerequisites
Network access to the app; no authentication or user interaction required.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
