What’s Vulnerable › Vulnerabilities

CVE-2025-12655: Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-12 · updated 2026-10-07
• Weakness: CWE-862

Description

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.

Affected products

• hippooo Hippoo Mobile App for WooCommerce: through 1.7.1

References

• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/utils.php#L1
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L117
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L45
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d34701a0-c745-441c-8d6c-7befc877f8d0?source=cve

Get alerted when CVE-2025-12655 or the next vulnerability affects your stack