CVE-2026-111601 hippooo CVE debrief

Who should care

Defenders responsible for WordPress installations with the vulnerable plugin should assess exposure and prioritize verification and potential upgrades. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-111601 is a Reflected Cross-Site Scripting vulnerability in the Hippoo Mobile App for WooCommerce plugin for WordPress. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the plugin.

• User interaction with the plugin can lead to execution of arbitrary web scripts
• Successful exploitation requires tricking a user into performing an action such as clicking on a link
• Defenders should verify the presence of this vulnerability in their WordPress installations

Technical summary

The vulnerability exists in the Hippoo Mobile App for WooCommerce plugin for WordPress, specifically in the 'token_id' parameter, which allows for Reflected Cross-Site Scripting attacks due to insufficient input sanitization and output escaping. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the plugin.

Recommended defensive actions

• Verify the presence of the vulnerable plugin in your WordPress installation
• Assess exposure of user interactions with the plugin
• Consider upgrading to a patched version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. The CVE record was published on 2026-10-17T03:16:28.613Z and has not been modified since then. The details indicate that the vulnerability exists in the Hippoo Mobile App for WooCommerce plugin for WordPress, specifically in the 'token_id' parameter. The information provided suggests that defenders should verify the presence of this vulnerability in their WordPress installations and assess exposure of user

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.