CVE-2026-49065: WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability
Published Jun 15, 2026
·Updated
Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.
Affected Software
1 affected component
Hippoo Hippoo Mobile App for WooCommerce<=1.9.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Hippoo Mobile App for WooCommerce Pluginto a version that resolves this vulnerability.Fixed in 1.9.6
Event History
Jun 15, 2026
CVE Published
via MITRE·08:19 PM
Data Sourced
via MITRE·08:19 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-49065?
CVE-2026-49065 has a high severity score of 8.2.
2
How do I fix CVE-2026-49065?
To fix CVE-2026-49065, update the Hippoo Mobile App for WooCommerce plugin to version 1.9.6 or later.
3
What type of vulnerability is CVE-2026-49065?
CVE-2026-49065 is classified as an unauthenticated Broken Access Control vulnerability.
4
What versions are affected by CVE-2026-49065?
CVE-2026-49065 affects the Hippoo Mobile App for WooCommerce plugin versions up to and including 1.9.5.
5
Is authentication required to exploit CVE-2026-49065?
No, CVE-2026-49065 can be exploited without authentication.