CVE-2026-49060

CRITICAL EXPLOITED LAB

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

Title source: cna

Exploitation Summary

CVE-2026-49060 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including rootdirective-sec.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-49060, targeting an authentication bypass vulnerability in the Hippoo plugin for WordPress. The PoC includes a Python script to validate the vulnerability by probing REST endpoints and attempting unauthenticated password updates.

Description

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

Exploits (1)

nomisec WORKING POC

by rootdirective-sec · remote

https://github.com/rootdirective-sec/CVE-2026-49060-Lab

View Code ZIP pw:eip

This repository contains a functional exploit PoC for CVE-2026-49060, targeting an authentication bypass vulnerability in the Hippoo plugin for WordPress. The PoC includes a Python script to validate the vulnerability by probing REST endpoints and attempting unauthenticated password updates.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Hippoo plugin for WordPress (versions 1.9.4 and earlier)

No auth needed

Prerequisites: WordPress with Hippoo plugin installed · REST API accessible

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1078 - Valid Accounts

mistral-large-3 · analyzed Jun 17, 2026 Full analysis →

References (1)

Core 1

Core References

Vdb Entry vdb-entry

https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-4-privilege-escalation-vulnerability?_s_id=cve

Scores

CVSS v3 9.8

EPSS 0.0051

EPSS Percentile 40.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Lab Environment

COMMUNITY

Community Lab

docker pull cve-2026-49060-vuln:1.9.4

docker pull cve-2026-49060-patched:1.9.5

docker pull wordpress:6.8.1-php8.2-apache

https://github.com/rootdirective-sec/CVE-2026-49060-Lab

View in Library

Details

VulnCheck KEV 2026-06-08

CWE

CWE-266

Status published

Products (1)

Hippoo/Hippoo Mobile App for WooCommerce < 1.9.4

Published Jun 11, 2026

Tracked Since Jun 12, 2026