CVE-2025-12655

Executive Summary

CVE-2025-12655 is a critical vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to and including 1.7.1). The flaw resides in the REST API endpoint /wp-json/hippoo/v1/wc/token/save_callback/{token_id}, which is registered with permission_callback => '__return_true'. This misconfiguration allows unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory. While the CVSS score is 5.3 (Medium), the ability to write arbitrary files to a web-accessible directory can lead to further exploitation, such as storing malicious payloads or defacing the site. The vendor has not released a patch, and no official fix is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised plugin updates or malicious forks.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthenticated file writes, but only JSON content to a specific directory. However, this can be chained with other vulnerabilities (e.g., stored XSS, PHP file inclusion) to escalate impact.

Deep Dive & Mechanics

The vulnerability exists in the Hippoo Mobile App for WooCommerce plugin, which registers a REST API endpoint for saving WooCommerce tokens. The endpoint /wp-json/hippoo/v1/wc/token/save_callback/{token_id} is intended for authenticated users but is misconfigured with permission_callback => '__return_true', meaning no authentication is required.

The endpoint accepts a token_id parameter and writes JSON data to the server's upload directory (typically /wp-content/uploads/). The exact file path is constructed using the token_id and a predefined directory. An attacker can craft a request to write arbitrary JSON content, potentially overwriting existing files or creating new ones.

Key Code Snippet (Vulnerable):

register_rest_route('hippoo/v1', '/wc/token/save_callback/(?P<token_id>[a-zA-Z0-9-]+)', array(
    'methods' => 'POST',
    'callback' => 'hippoo_save_callback',
    'permission_callback' => '__return_true', // <-- Vulnerability
));

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a POST request to /wp-json/hippoo/v1/wc/token/save_callback/evil_token with JSON body.
3. The plugin writes the JSON content to /wp-content/uploads/hippoo/evil_token.json.
4. The attacker can then access the file via the web, potentially using it for further attacks (e.g., storing malicious JavaScript for XSS).

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.7.1):

register_rest_route('hippoo/v1', '/wc/token/save_callback/(?P<token_id>[a-zA-Z0-9-]+)', array(
    'methods' => 'POST',
    'callback' => 'hippoo_save_callback',
    'permission_callback' => '__return_true',
));

Patched Code (Hypothetical):

register_rest_route('hippoo/v1', '/wc/token/save_callback/(?P<token_id>[a-zA-Z0-9-]+)', array(
    'methods' => 'POST',
    'callback' => 'hippoo_save_callback',
    'permission_callback' => function() {
        return current_user_can('manage_woocommerce');
    },
));

The patch would require authentication and appropriate capabilities (e.g., manage_woocommerce) before allowing file writes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Hippoo Mobile App for WooCommerce plugin <= 1.7.1.
• Network access to the site.

Exploit Steps:

1. Identify the target WordPress site.
2. Send a POST request to the vulnerable endpoint with arbitrary JSON data.

Example cURL Command:

curl -X POST https://target.com/wp-json/hippoo/v1/wc/token/save_callback/evil_payload \
  -H "Content-Type: application/json" \
  -d '{"malicious": "data"}'

Expected Result: The file /wp-content/uploads/hippoo/evil_payload.json is created with the content {"malicious": "data"}.

Advanced Exploitation:

• Use path traversal in token_id to write files outside the intended directory (if not sanitized).
• Chain with a file inclusion vulnerability to execute arbitrary code.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for POST requests to /wp-json/hippoo/v1/wc/token/save_callback/ from unauthenticated sources.
2. Check the /wp-content/uploads/hippoo/ directory for unexpected JSON files.
3. Review web server logs for unusual token_id values (e.g., containing path traversal characters like ../).

Response:

• Immediately disable the plugin if no patch is available.
• Remove any unauthorized files from the uploads directory.
• Implement a Web Application Firewall (WAF) rule to block the vulnerable endpoint for unauthenticated users.

Indicators of Compromise (IOCs)

• File Path: /wp-content/uploads/hippoo/*.json (unexpected JSON files)
• HTTP Request: POST to /wp-json/hippoo/v1/wc/token/save_callback/{token_id} with no authentication headers.
• Log Entry: POST /wp-json/hippoo/v1/wc/token/save_callback/ with status 200 and no Authorization header.
• Network Traffic: Unauthenticated POST requests to the REST API endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_12655_Hippoo_FileWrite {
    meta:
        description = "Detects arbitrary file write via Hippoo plugin CVE-2025-12655"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12655"
    strings:
        $endpoint = "/wp-json/hippoo/v1/wc/token/save_callback/"
        $permission = "__return_true"
    condition:
        $endpoint or $permission
}

Sigma Rule

title: CVE-2025-12655 - Hippoo Plugin Unauthenticated File Write
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated POST requests to the Hippoo plugin's vulnerable REST API endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem|startswith: '/wp-json/hippoo/v1/wc/token/save_callback/'
    condition: selection
falsepositives:
    - Legitimate plugin updates (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12655 - Hippoo Plugin Unauthenticated File Write"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-json/hippoo/v1/wc/token/save_callback/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any unauthorized files from /wp-content/uploads/hippoo/.
3. Implement a WAF rule to block unauthenticated POST requests to /wp-json/hippoo/v1/wc/token/save_callback/*.

Long-term Fix:

• The vendor must release a patched version that implements proper authentication (e.g., permission_callback => 'is_user_logged_in' or a capability check).
• Users should monitor the WordPress plugin repository for updates.

Workaround:

• Add a custom function to your theme's functions.php to override the endpoint's permission callback:

add_filter('rest_pre_dispatch', function($result, $server, $request) {
    if (strpos($request->get_route(), 'hippoo/v1/wc/token/save_callback') !== false) {
        if (!is_user_logged_in()) {
            return new WP_Error('rest_forbidden', 'Unauthorized', array('status' => 401));
        }
    }
    return $result;
}, 10, 3);

Valters IT
Cyber Threat Intelligence & DevSecOps