Exploit for By-Poloss..-..

CVE-2026-10580

kitploit · 2026-08-24

Description

Unauthenticated auth bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 enables admin takeover.

Entry point

Parameterpassword · request body

Pathwc-hippoo/v1/ext/wp/v2/users/<id>

Authentication bypass allows unauthenticated attackers to reset any WordPress user password via the wp/v2 users endpoint.

CVSS 9.8 for CVE-2026-10580

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

2.9%higher than 86.1% of all CVEs

Updated 2026-08-28

Exploit Details

Modified:2026-08-24 18:42

Last Seen:2026-08-26 10:02

Reporter:KitPloit

Other exploits for CVE-2026-10580

CVE-2026-10580

2026-08-26 KitPloitKITPLOIT

Exploit for CVE-2026-10580

2026-06-30 0xgh057r3c0nGITHUB

Exploit Code

MARKDOWN10 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-POLOSSS-BY-POLOSS..-..CVE-2026-10580
# CVE-2026-10580: Hippoo Mobile App per WooCommerce <= 1.9.4 - Bypass dell'autenticazione non autenticata per compromissione admin

![](https://img.shields.io/badge/CVE-2026--10580-red) ![](https://img.shields.io/badge/CVSS-9.8-CRITICAL-brightred) ![](https://img.shields.io/badge/WordPress-WooCommerce-blue) ![](https://img.shields.io/badge/Version-%3C=1.9.4-orange) ![](https://img.shields.io/badge/PoC-100%25-success)

**Non autenticato → Compromissione account amministratore tramite bug di confluenza logica**

* * *

## 📌 Riepilogo

Exploit Code

Share

Share on social media: