📄 WordPress Hippoo 1.9.5 Unauthenticated Admin Account Takeover

WordPress Hippoo plugin version 1.9.5 contains an unauthenticated admin account takeover vulnerability through REST. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3...