https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:34:06 +0000 https://cve.radiocsirt.org/vuln/cve-2025-12655 <p><strong>Affected:</strong> hippooo Hippoo Mobile App for WooCommerce</p> <p>The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback =&gt; &#39;__return_true&#39;`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server&#39;s publicly accessible upload directory via the vulnerable endpoint.</p> <p><strong>Affected:</strong> hippooo Hippoo Mobile App for WooCommerce</p> <p>The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback =&gt; &#39;__return_true&#39;`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server&#39;s publicly accessible upload directory via the vulnerable endpoint.</p> https://cve.radiocsirt.org/vuln/cve-2025-12655