CVE-2025-12655 – This vulnerability allows unauthenticated attac... (How to Fix)

📋 TL;DR

This vulnerability allows unauthenticated attackers to write arbitrary JSON files to the server's publicly accessible upload directory via a misconfigured REST API endpoint in the Hippoo Mobile App for WooCommerce WordPress plugin. Any WordPress site running the vulnerable plugin version is affected. The issue stems from missing authorization checks that grant public access to a file-writing function.

💻 Affected Systems

Products:

Hippoo Mobile App for WooCommerce WordPress plugin

Versions: All versions up to and including 1.7.1

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with the Hippoo plugin active. The upload directory must be publicly accessible for full impact.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could write malicious JSON files containing web shells or other payloads to the upload directory, potentially leading to remote code execution, data theft, or complete site compromise.

🟠

Likely Case

Attackers will write arbitrary JSON files to the upload directory, which could be used for defacement, storing malicious data, or as a stepping stone for further attacks.

🟢

If Mitigated

With proper file permissions and web server configuration, the impact is limited to unauthorized file creation in the uploads folder without execution capabilities.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is straightforward to exploit with simple HTTP POST requests to the vulnerable endpoint. No authentication or special conditions required.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.7.2 or later

Vendor Advisory: https://plugins.trac.wordpress.org/browser/hippoo/tags/1.7.2

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Hippoo Mobile App for WooCommerce'
4. Click 'Update Now' if update is available
5. Alternatively, download version 1.7.2+ from WordPress.org and manually replace plugin files

🔧 Temporary Workarounds

Disable vulnerable REST endpoint

all

Remove or restrict access to the vulnerable REST API endpoint via .htaccess or web server configuration

# Add to .htaccess
RewriteRule ^wp-json/hippoo/v1/wc/token/save_callback/ - [F,L]

Deactivate plugin

linux

Temporarily disable the Hippoo plugin until patched

wp plugin deactivate hippoo

🧯 If You Can't Patch

Immediately deactivate the Hippoo Mobile App for WooCommerce plugin
Implement web application firewall rules to block requests to /wp-json/hippoo/v1/wc/token/save_callback/

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Hippoo Mobile App for WooCommerce. If version is 1.7.1 or lower, you are vulnerable.

Check Version:

wp plugin list --name=hippoo --field=version

Verify Fix Applied:

After updating, verify plugin version is 1.7.2 or higher. Test the endpoint with unauthenticated POST request - should return 401/403.

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /wp-json/hippoo/v1/wc/token/save_callback/ from unauthenticated users
Unusual file creation in wp-content/uploads/hippoo/ directory

Network Indicators:

POST requests to the vulnerable endpoint without authentication headers
JSON file uploads to unexpected locations

SIEM Query:

source="web_logs" AND uri="/wp-json/hippoo/v1/wc/token/save_callback/" AND http_method="POST" AND NOT user_agent="WordPress/*"

📊 Metadata

CVE ID: CVE-2025-12655

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-862

EPSS Score: 0.09% exploit probability (25.7th percentile)

Published: December 12, 2025

Last Updated: December 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-12655, you might also want to check these: