Hippoo-Mobile-App-for-WooCommerce-CVE-Report

Disclosure for CVE-2025-13339

CVE-2025-13339 - Vulnerability in Hippoo Mobile App for WooCommerce

This repository discloses a vulnerability discovered in Hippoo Mobile App for WooCommerce <= 1.6.1,WordPress plugin developed by hippooo.

🛠 Affected Version

Product: Hippoo Mobile App for WooCommerce
Version: v1.6.1
URL: https://wordpress.org/plugins/hippoo

🔒 Assigned CVE

CVE ID	Type	Component	Impact
CVE-2025-13339	Unauthenticated Arbitrary File Read	hippoo/app/pwa.php	Unauthenticated Arbitrary File Read(e.g. wp-config.php)

🧾 Detailed a Description

CVE-2025-13339 — Unauthenticated Arbitrary File Read

Affected Component: Hippoo Mobile app for WooCommerce - PWA routing
Attack Vector: Unauthenticated path traversal via the hippoo_serve query parameter.
Trigger: The plugin registers the custom query var hippoo_serve and, inside HippooPwa::template_redirect() builds a file path by concatenating it directly.

http://localhost:8080/?hippoo_serve=../../../../wp-config.php

Impact: Unauthenticated arbitrary file read (AFD/LFI). An attacker can disclose sensitive files readable by the PHP process, including:
wp-config.php (database credentials, authentication salts/keys)
Web server configuration files (e.g., .htaccess)
Various log files or other configuration/secret material, depending on server layout and permissions

Exposure of wp-config.php alone is typically sufficient to compromise the database and can lead to full site takeover.

❓Reason for the vulnerability

The hippoo_serve handling in HippooPwa::template_redirect() is executed on the public front-end with no capability or authentication checks, so anyone (including unauthenticated visitors) can trigger the file serving logic.

To rectify this, you must add an authorisation check current_user_can(“manage_options”) and ensure external input is not added directly to the path.

ひとこと

初めての任意ファイル読み取り脆弱性　wp-config.phpが読めるなら、結構クリティカルな脆弱性に昇華出来るので、もうちょっと報奨金欲しかった気持ちがある... でも自分はWordFence様にいくつものゴミレポートを送ってしまっているので、頭が上がりません。

🔍 Discoverer

Name: MooseLove
Role: Independent security researcher / bug hunter
Contact: Available upon request

📚 References

Product: https://wordpress.org/plugins/hippoo

⚠️ License

This advisory is provided for public security awareness. Free to share with attribution.

Hippoo-Mobile-App-For-WooCommerce-CVE-Report

Most Popular