Hippoo Mobile App for WooCommerce Missing Authorization Vulnerability Allowing Arbitrary File Write

A vulnerability exists in the Hippoo Mobile App for WooCommerce plugin for WordPress, in all versions through 1.7.1. The issue arises from a missing authorization check in a REST API endpoint, which is registered to allow unauthenticated access. This flaw enables unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory.

Impact

Exploitation of this vulnerability allows for unauthorized writing of files to the server, potentially leading to arbitrary file upload issues.

Remediation

Users are advised to update the Hippoo Mobile App for WooCommerce plugin to version 1.7.2 or a newer patched version.