Hippoo Mobile App for WooCommerce

Hippoo Mobile App for WooCommerce is a WordPress plugin with the following stats:

#3,746 Global Rank

1K+ active installs

4.9/5 7 ratings

Since 2023 3 years active

Vulnerabilities

4 Total

4 Patched

0 Active

100% Resolved rate

Hippoo Mobile App for WooCommerce <= 1.9.5 - Missing Authorization

CWE-862 · Missing Authorization

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.9.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

5.3 Medium Affected All – 1.9.5 Patched in ✓ 1.9.6 Published 8 Jun 2026 CVE CVE-2026-49065

Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API

CWE-285 · Improper Authorization

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/ with a {"password":""} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site. CVE-2026-49060 is a duplicate of this issue.

9.8 Critical Affected All – 1.9.4 Patched in ✓ 1.9.5 Published 5 Jun 2026 CVE CVE-2026-10580

Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write

CWE-862 · Missing Authorization

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.

5.3 Medium Affected All – 1.7.1 Patched in ✓ 1.7.2 Published 11 Dec 2025 CVE CVE-2025-12655

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

7.5 High Affected All – 1.7.1 Patched in ✓ 1.7.2 Published 9 Dec 2025 CVE CVE-2025-13339

About Hippoo Mobile App for WooCommerce

Hippoo helps you manage WooCommerce orders, inventory, and analytics from your mobile. Receive real-time notifications and control your store on the g …

Hippoo WooCommerce App | Your Store, Anywhere, Anytime

The Hippoo WooCommerce app is a powerful extension that enhances the functionality of your WooCommerce shop. Seamlessly integrate your shop with the Hippoo mobile app (both Android and iOS) to unlock advanced features, including the creation of out-of-stock lists, adding images to order products via API, and user authentication for optimal app utilization. Take control of your shop’s inventory, order fulfillment, and customer engagement with ease.

Key Features:

Advanced Sales Analytics: Track revenue, top-selling products, and trends with a custom date range for deeper insights.
Instant Order Notifications: Receive real-time alerts for new orders directly on your Android or iPhone.
Stock Alerts: Get notified immediately when a product goes out of stock to prevent missed sales.
Create & Edit Orders/Products: Customize orders and products with advanced options, including pricing, variations, and attributes.
Barcode Scanner: Quickly find orders or products by scanning barcodes for faster search and management.
WordPress Media Gallery Access: Upload, delete, and share media directly from your WooCommerce store.
Team Collaboration & Order Sharing: Share or duplicate orders easily with your team to improve efficiency.
Create and Manage Coupons: Easily generate, customize, and share discount coupons with customers to boost sales.
Out-of-Stock Management: View a recent out-of-stock list and efficiently manage inventory replenishment.
Invoice & Shipping Label Creation: Generate and customize invoices and shipping labels with automatic order details.
iOS & Android Home Screen Widget: Quickly access your shop reports from your mobile home screen for real-time insights.
Order Product Image API: Enhance order management with product images for better fulfillment and customer satisfaction.
Generate product content automatically using Hippoo AI by uploading or capturing a photo of your items.
Seamless integration with Shippo service to create courier shipping labels directly inside the Hippoo application.
Support for extensions such as Google Analytics, custom code snippets, customer support ticketing, recent activity logs, and more.
Custom event notifications for user registration, comment submission, custom order status changes, and additional triggers.
Barcode Generation: Display and print barcodes for product SKUs and order IDs. Quickly find orders and products by scanning barcodes.
Multi-Shop Management: Add and manage multiple WooCommerce stores for free—all in one app!
Third-Party Plugin Integration: Seamlessly connect with plugins like Koko Analytics for user statistics, Code Snippets for custom code management, Google Analytics for detailed insights, and more—all within the app with a native mobile experience.
Hundreds More Features: Enjoy a comprehensive toolset with exclusive WooCommerce management features you won’t find in other apps!

Progressive Web App (PWA) Support

Hippoo WooCommerce now enables a PWA for your store, allowing customers to install it on their devices. By default, a “Designed by Hippoo WooCommerce app” credit appears under the PWA. The entire PWA feature can be disabled in the settings.

Why Use Hippoo PWA for Instagram Shop?

The PWA is perfect for Instagram Shop because of its simple design, mobile-friendly interface, and fast performance. It uses the WooCommerce Store API, ensuring quick loading times and a smooth shopping experience for customers.

To install the Hippoo WooCommerce app on your phone:

For Android users: Visit the Google Play Store using the following link: Hippoo Android App.
For iPhone users: Visit the App Store using the following link: Hippoo iOS App.
Click on the “Install” button to download and install the Hippoo app on your mobile device.
Open the Hippoo app and follow the on-screen instructions to authenticate your shop and start utilizing the advanced features.

Short Description

Manage your WooCommerce store on the go with Hippoo. Receive real-time order notifications, manage inventory, and track sales—all from your mobile device.

Screenshots

Hippoo main dashboard in the app

Orders management in the app

Product list and inventory management

Edit product page

New orders notification

Create and edit coupons

Advanced sale analytics and top selling products

Changelog

1.10.3 – Add guest support, pagination, churn tools and traffic fixes for BI
1.10.2 – Include user info (display name and roles) in the BI overview response
1.10.1 – Include user display name and roles in the WooCommerce token show response
1.10.0 – Introducing Hippoo BI module for advanced sales and traffic insights
1.9.6 – Critical security bug fix
1.9.5 – Critical security fixes
1.9.4 – Harden hippoo_get_product_by_slug against non-array input from upstream central plugin catalog
1.9.3 – Update title
1.9.2 – minor improvements
1.9.0 – Add compatibility mode to fix WooCommerce API response type mismatches for Hippoo app
1.8.6 – Re-release of the stable 1.8.4 codebase after rolling back 1.9.x.
1.8.4 – Performance improvements, plus fixes for role and permission bugs
1.8.0 – Security Improvements
1.7.6 – Minor bug fix
1.7.6 – Fix role and permissions bug
1.7.5 – Revert a version to fix critical bug
1.7.4 – Add role and permissions
1.7.3 – Ability to install integrations
1.7.2 – Minor fixes
1.7.1 – Add Gemini Support for AI features
1.7.0 – Introducing Hippoo AI for generating product content from photos
1.6.1 – Added REST API troubleshooter and support for customizable invoice templates.
1.5.15 – Customize Notifications
1.5.14 – Minor Improvements
1.5.13 – Fix scripts.js url
1.5.12 – Minor Improvements
1.5.11 – Minor Bug Fix
1.5.10 – Media Upload compatibale with new wordpress updates
1.5.9 – Minor Improvements.
1.5.8 – Minor Improvements.
1.5.1 – Added PWA feature with optional store activation.
1.5.0 – Improvements & Enhancements Enhanced app functionality for a smoother user experience. Improved plugin authentication system, allowing seamless integration with third-party plugins. Optimized performance and security for better reliability.
1.4.3 – Updated the mobile notification text and title, Round the weight on orders
1.4.2 – Added invoice and shipping label creation, SKU barcode on product pages, and order ID barcode on order pages.
1.3.5 – Change the “Tested up to” value
1.3.4 – Add weight to order object
1.3.3 – Fix config UI and minor changes
1.3.2 – Handle remote json fetch failure
Add product images to orders
Add out-of-stock API
Hippoo app auth