The Hippoo Mobile App for WooCommerce plugin for WordPress contains a path traversal vulnerability (CWE-22) in the template_redirect() function. This flaw permits unauthenticated remote attackers to read arbitrary files on the server by manipulating file path inputs, bypassing intended directory restrictions. The vulnerability affects all versions up to 1.7.1. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed. No known exploits are reported in the wild, and no patch or official remediation guidance is currently available.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information, potentially compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin or disabling it if possible. Monitor official vendor channels for updates and apply patches promptly once available.