CVE-2025-12655

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.

• CWE-862

• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/utils.php#L1
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L117
• https://plugins.trac.wordpress.org/browser/hippoo/tags/1.6.1/app/web_api.php#L45
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d34701a0-c745-441c-8d6c-7befc877f8d0?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1265An OS command injection vulnerability exists in Vinci Protoc…9.9
• CVE-2025-12650The Simple post listing plugin for WordPress is vulnerable t…6.4
• CVE-2025-12651The Live Photos on WordPress plugin for WordPress is vulnera…6.4
• CVE-2025-12652The Ungapped Widgets plugin for WordPress is vulnerable to S…6.4
• CVE-2025-12653GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-12654The Migration, Backup, Staging – WPvivid Backup & Migration …2.7
• CVE-2025-12656The Migration, Backup, Staging – WPvivid Backup & Migration …3.8
• CVE-2025-12657The KMIP response parser built into mongo binaries is overly…5.5
• CVE-2025-12658The Preload Current Images plugin for WordPress is vulnerabl…6.4
• CVE-2025-12659Siemens Simcenter Femap contains a memory corruption vulnera…7.8
• CVE-2025-1266Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-12660The Padlet Shortcode plugin for WordPress is vulnerable to S…6.4