CVE-2026-49060-Lab

CVE-2026-49060 - Hippoo Mobile App for WooCommerce 权限分配错误 / 权限提升 摘要 本仓库提供了一个本地 Docker 实验室环境，用于复现和验证 CVE-2026-49060，这是一个影响 WordPress 插件 Hippoo Mobile App for WooCommerce 的权限分配错误漏洞。 该漏洞行为通过 Hippoo 克隆的 REST API 命名空间暴露：text /wc-hippoo/v1/ext/ root@kitploit: 在易受攻击的目标中，未认证的访问者可以访问克隆的WordPress...

CVE-2025-12655

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...

CVE-2025-12655

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...