CVE-2025-13339

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

Published Dec 10, 2025 CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed

Description

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Analysis

Technical impact

The Hippoo Mobile App for WooCommerce plugin is susceptible to a path traversal flaw in all releases up to and including 1.7.1. The flaw lies within the template_redirect() function, enabling attackers who need not authenticate to obtain the contents of any file on the server. This can expose private configuration files, credentials, or other sensitive data, thereby compromising confidentiality and potentially allowing further exploitation.

Affected Systems

WordPress sites using the Hippooo Mobile App for WooCommerce plugin, specifically versions 1.7.1 and earlier. All installs of the plugin found in the WordPress plugin repository that match these versions are affected.

Risk and Exploitability

With a CVSS of 7.5 the vulnerability is classified as high severity, and the EPSS score of 2% indicates a lower likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a web request to a directed URL that triggers template_redirect; no authentication is required. Overall, the risk is high, especially for sites handling sensitive information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

hippooo

Hippoo Mobile App for WooCommerce

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.7.1

No data.

Vendor	Product	Versions
Hippooo	Hippoo Mobile App For Woocommerce	—
Woocommerce	Woocommerce	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Hippooo Mobile App for WooCommerce plugin to version 1.7.2 or later in order to eliminate the path traversal flaw.
If an update is not immediately possible, disable the plugin to prevent the vulnerability from being exploitable.
Implement file system permissions that restrict the web server’s access to irrelevant configuration files, thereby reducing the potential impact of a path traversal attempt.

Generated by OpenCVE AI on June 18, 2026 at 02:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.4% (2.371% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3412701/
https://www.wordfence.com/threat-intel/vulnerabilities/id/06900b4b-6607-4b25-b4bc-2e2906160421?source=cve

History

Dec 10, 2025 6:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hippooo Hippooo hippoo Mobile App For Woocommerce Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress
Vendors & Products		Hippooo Hippooo hippoo Mobile App For Woocommerce Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress

Dec 10, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 10, 2025 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Title		Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
Weaknesses		CWE-22
References		https://plugins.trac.wordpress.org/changeset/3412701/ https://www.wordfence.com/threat-intel/vulnerabilities/id/06900b4b-6607-4b25-b4bc-2e2906160421?source=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`