This vulnerability, identified as CWE-266, involves incorrect privilege assignment in the Hippoo Mobile App for WooCommerce, allowing an attacker to escalate privileges. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions include all versions up to 1.9.4. No vendor advisory or patch information is available, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation of this vulnerability can lead to complete privilege escalation, granting an attacker unauthorized access to sensitive functions or data within the Hippoo Mobile App for WooCommerce. This can compromise the confidentiality, integrity, and availability of the application and its data. Given the critical CVSS score, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor vendor communications closely and apply any updates once released. Until then, restrict access to the application to trusted users only and consider additional access controls where possible.