CVE-2026-49060: WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

Synopsis

An incorrect privilege assignment vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to and including 1.9.4) allows an unauthenticated remote attacker to escalate their privileges within the application. The vulnerability is reachable over the network, requires no authentication, and involves no victim interaction. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected WordPress/WooCommerce installation. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send a crafted HTTP request from any internet-accessible location.

• AuthenticationNot required

  No account or credentials of any kind are needed to trigger the privilege escalation.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploit conditions are straightforward and consistent; no race conditions, specific memory layout, or environmental prerequisites are required.

Blast Radius

• A successful attacker gains elevated (potentially administrative) privileges within the WordPress and WooCommerce installation, enabling full account takeover.
• With high integrity impact, the attacker can create, modify, or delete product listings, orders, customer records, and site configuration.
• With high confidentiality impact, the attacker reads stored customer personally identifiable information, payment metadata, session tokens, and WooCommerce order data.
• With high availability impact, the attacker can disable the plugin, corrupt store data, or take down the WordPress site entirely.