CVE-2025-13339: Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the templateredirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13339?
CVE-2025-13339 is considered a high severity vulnerability due to its ability to allow unauthenticated attackers to read arbitrary files on the server.
How do I fix CVE-2025-13339?
To fix CVE-2025-13339, update the Hippoo Mobile App for WooCommerce plugin to the latest version that addresses this vulnerability.
Who is affected by CVE-2025-13339?
Any WordPress site using the Hippoo Mobile App for WooCommerce plugin version 1.7.1 or earlier is affected by CVE-2025-13339.
What does CVE-2025-13339 exploit?
CVE-2025-13339 exploits a Path Traversal vulnerability through the template_redirect() function in the affected plugin.
Can CVE-2025-13339 be exploited remotely?
Yes, CVE-2025-13339 can be exploited remotely by unauthenticated attackers.