WordPress Plugin Vulnerabilities

Hippoo Mobile App for WooCommerce < 1.7.2 - Unauthenticated Arbitrary File Read

Description

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affects Plugins

Plugin icon
hippoo
Fixed in 1.7.2

References

CVE
CVE-2025-13339
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/06900b4b-6607-4b25-b4bc-2e2906160421

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Moose Love
Verified
No
WPVDB ID
c4383769-6da5-428e-9dc7-e15bab49c4ea

Timeline

Publicly Published
2025-12-09 (about 9 months ago)
Added
2025-12-09 (about 9 months ago)
Last Updated
2025-12-10 (about 9 months ago)

Other

Published
Title
Published
2024-04-26
Title
BackUpWordPress < 3.14 - Admin+ Directory Traversal
Published
2026-09-09
Title
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
Published
2025-06-24
Title
FW Food Menu <= 6.0.0 - Unauthenticated Arbitrary File Deletion
Published
2026-06-05
Title
10WebAdManager <= 1.0.11 - Unauthenticated Arbitrary File Download
Published
2025-07-11
Title
RSFirewall! < 1.1.43 - Authenticated (Admin+) Arbitrary File Read