CVE-2026-10580 is an authentication bypass vulnerability in the Hippoo Mobile App for WooCommerce plugin for WordPress, affecting all versions prior to 1.9.5. The root cause is a logic conflation in HippooPermissions::get_user_permissions() which returns the same null sentinel value for both administrators and unauthenticated users. HippooPermissions::has_role_access() interprets this null value as full administrator access. Consequently, override_extension_permission_callback() assigns a permission callback that always returns true for all REST routes cloned under /wc-hippoo/v1/ext/. The pre-dispatch guard block_unauthorized_access() fails to block unauthenticated users due to this logic error. This allows unauthenticated attackers to invoke any core REST endpoint, including POST requests to /wc-hippoo/v1/ext/wp/v2/users/<id> with a JSON body to reset passwords of any WordPress user, enabling administrator account takeover.

An unauthenticated attacker can bypass authentication controls and gain full administrative access to the WordPress site by resetting any user's password, including administrators. This leads to complete site compromise with confidentiality, integrity, and availability impacts rated high. The vulnerability has a CVSS score of 9.8, indicating critical severity.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor advisory for updates. Until a fix is available, consider disabling the Hippoo Mobile App for WooCommerce plugin or restricting access to the affected REST API endpoints if possible. Avoid exposing the /wc-hippoo/v1/ext/ REST routes to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.