The Hippoo Mobile App for WooCommerce plugin is vulnerable because a REST API endpoint allows file write without any authentication. An attacker can submit arbitrary JSON payloads to the endpoint and have them stored in the site's public upload directory, potentially leading to malicious scripts or data being placed on the server. The flaw is a missing permission callback, classified as CWE-862, and can compromise confidentiality, integrity, or availability if the attacker injects code.

All installations of the Hippoo Mobile App for WooCommerce plugin up to and including version 1.7.1 are affected. The vulnerability exists in the plugin’s REST API implementation and applies to any WordPress site running these versions.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of assessment. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the fault simply by accessing the unauthenticated REST endpoint, which requires network access to the site but no credentials. Successful exploitation would grant arbitrary file writes, which could in turn enable remote code execution or site defacement if the uploaded file is executed by the web server.