The Hippoo Mobile App for WooCommerce plugin is susceptible to a path traversal flaw in all releases up to and including 1.7.1. The flaw lies within the template_redirect() function, enabling attackers who need not authenticate to obtain the contents of any file on the server. This can expose private configuration files, credentials, or other sensitive data, thereby compromising confidentiality and potentially allowing further exploitation.

WordPress sites using the Hippooo Mobile App for WooCommerce plugin, specifically versions 1.7.1 and earlier. All installs of the plugin found in the WordPress plugin repository that match these versions are affected.

With a CVSS of 7.5 the vulnerability is classified as high severity, and the EPSS score of less than 1% indicates that exploitation is currently unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a web request to a directed URL that triggers template_redirect; no authentication is required. Overall, the risk is moderate to high, especially for sites handling sensitive information.