CVE-2026-111601

Executive Summary

CVE-2026-111601 is a reflected Cross-Site Scripting (XSS) vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin affecting all versions up to and including 1.12.0. The flaw resides in handling of the token_id parameter, where insufficient input sanitization and output escaping—combined with a WordPress REST routing weakness—allows unauthenticated attackers to inject arbitrary scripts into pages. Exploitation requires user interaction (a victim clicking a crafted link) but can result in script execution in the context of the vulnerable site, with a CVSS v3.1 base score of 6.1 (Medium).

Technical Analysis

The vulnerability is a reflected XSS (CWE-79) reachable via the WordPress REST API surface of the Hippoo Mobile App for WooCommerce plugin. Per the NVD description, the plugin's routing logic applies a URL path regex intended to constrain a path segment to word characters (\w-style), which would normally limit what input reaches the handler. However, WordPress's WP_REST_Request class resolves query-string parameters with higher precedence than path-derived values. As a result, an attacker can supply ?token_id=<payload> in the query string, which overrides the regex-constrained path segment and is delivered to the handler "verbatim," fully bypassing the intended constraint.

The root cause is two-fold:

1. Insufficient input sanitization — the token_id value is not sanitized before being processed, so metacharacters required for script injection survive into the response.
2. Insufficient output escaping — the value is reflected into an HTML response without proper context-aware encoding, allowing injected markup to be interpreted by the browser as executable script.

The routing bypass is the notable aspect: the developer attempted to defend the endpoint by constraining a path segment, but that control is ineffective because WP_REST_Request merges query parameters over path parameters. This is a logic/design error rather than a missing check, and it means the regex provides no real protection.

Attack surface: any WordPress installation running the affected plugin version with its REST endpoints reachable. The endpoint is unauthenticated (PR:N) and remotely reachable (AV:N). The primary constraint on exploitation is the user-interaction requirement (UI:R) — the attacker must induce a victim to load a crafted URL.

No public proof-of-concept, Nuclei template, or exploit code was available at the time of analysis. The precise endpoint path and handler function names are not stated in the available description and are therefore not enumerated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (reflected XSS via REST parameter override).

1. Reconnaissance / target identification. The attacker enumerates WordPress sites and fingerprints the Hippoo Mobile App for WooCommerce plugin (e.g., via plugin asset paths and version detection). Targets running version 1.12.0 or earlier are prioritized.

2. Triggering the flaw. The attacker constructs a URL that points at the plugin's REST endpoint and appends a query string of the form ?token_id=<malicious-value>. Because WP_REST_Request gives query-string parameters precedence over the regex-constrained path segment, the supplied value reaches the response-handling code without being constrained by the intended word-character filter.

3. Payload / delivery. The unsanitized token_id value is reflected into the returned page without output escaping, so a script payload embedded in the parameter executes in the victim's browser. Delivery is social-engineering based: the attacker distributes the crafted link (email, chat, forum) and relies on the victim clicking it — consistent with the UI:R vector.

4. Post-exploitation impact. Successful execution yields script running in the origin of the vulnerable WordPress site. In a WooCommerce context this could allow actions performed as the victim (e.g., reading page data available to the browser, redirection, or manipulation of the page the victim sees). CVSS scope is Changed (S:C), reflecting that impact may extend beyond the vulnerable component's own security authority. The confidentiality and integrity impacts are rated Low (C:L/I:L) and availability is None (A:N).

Impact Assessment

• Confidentiality (C:L): Script execution may expose limited data available to the victim's browser session on the affected origin.
• Integrity (I:L): The attacker can alter what the victim sees and potentially perform limited actions in the victim's context.
• Availability (A:N): No availability impact.
• Scope (S:C): Impact may cross a trust boundary, since script runs in the context of the hosting site (which may be more privileged/trusted than the vulnerable plugin component).
• Privileges (PR:N) / Attack Vector (AV:N): Remotely exploitable without authentication.
• User Interaction (UI:R): Requires a victim to click a crafted link.

Business impact: For WooCommerce merchants, reflected XSS can be used in phishing campaigns that abuse the trusted store domain, enabling credential-theft page overlays, malicious redirects, or session manipulation targeted at customers and administrators. Because exploitation requires luring a user, mass opportunistic scanning is plausible but targeted social engineering yields higher value. Blast radius is limited to installations running the affected plugin (≤1.12.0) with reachable REST endpoints. No CISA KEV listing and no EPSS score currently exist, indicating no confirmed in-the-wild exploitation at time of writing.

Detection Guidance

Sigma Rule

title: Hippoo WooCommerce Reflected XSS via token_id Query Parameter
id: 3f9c1a72-6b2e-4d8a-9c11-hipoo111601
status: experimental
description: Detects requests where a token_id query parameter contains script-injection metacharacters against WordPress REST endpoints, consistent with CVE-2026-111601 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111601
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains: 'token_id='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '"><'
  condition: selection_path and selection_payload
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate token_id values containing encoded characters
level: medium

YARA Rule

rule CVE_2026_111601_Hippoo_XSS_Request
{
    meta:
        description = "Detects HTTP request artifacts targeting Hippoo WooCommerce token_id reflected XSS"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111601"
        cve = "CVE-2026-111601"
        date = "2026-01-01"
    strings:
        $param = "token_id=" ascii nocase
        $x1 = "<script" ascii nocase
        $x2 = "%3Cscript" ascii nocase
        $x3 = "onerror=" ascii nocase
        $x4 = "onload=" ascii nocase
        $x5 = "javascript:" ascii nocase
        $http = "HTTP/" ascii
    condition:
        $http and $param and any of ($x*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111601 Hippoo WooCommerce token_id Reflected XSS Attempt"; flow:established,to_server; http.uri; content:"token_id="; nocase; http.uri; pcre:"/(\%3C|<)script|javascript:|onerror=|onload=/i"; classtype:web-application-attack; reference:cve,2026-111601; sid:2026111601; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1s
  [network where http.request.method == "GET" and
     wildcard(http.request.uri.query, "*token_id=*")]
  [network where http.request.method == "GET" and
     wildcard(http.request.uri.query, "*<script*") or
     wildcard(http.request.uri.query, "*%3Cscript*") or
     wildcard(http.request.uri.query, "*onerror=*") or
     wildcard(http.request.uri.query, "*javascript:*")]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| eval q=lower(coalesce(uri_query, cs_uri_query))
| where like(q,"%token_id=%")
| where match(q,"(<script|%3cscript|javascript:|onerror=|onload=)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri_path uri_query
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve_2026_111601,">
  <rule id="111601" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>token_id=</match>
    <regex type="pcre2">(?i)(%3C|<)script|javascript:|onerror=|onload=</regex>
    <description>CVE-2026-111601: Hippoo WooCommerce token_id reflected XSS attempt detected</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1) Immediate mitigations

• If the plugin's mobile-app functionality is not in active use, disable/deactivate the Hippoo plugin until a confirmed fix is validated.
• Front the site with a WAF (or apply virtual-patch rules) that rejects token_id query values containing script metacharacters (<, %3C, javascript:, event-handler patterns).
• Restrict access to the plugin's REST endpoints where feasible (e.g., only permit authenticated/internal traffic).
• Reinforce user awareness against clicking untrusted links that target the store domain.

2) Patch / upgrade steps

• Monitor the vendor/WordPress plugin repository for a release beyond 1.12.0 and confirm on the vendor's official changelog that the token_id handling and REST query-precedence bypass are addressed before treating the issue as fixed.
• Test the update in staging, then deploy. Because patch status is unconfirmed (single-source claim), verify the fix independently (e.g., re-test the ?token_id= override path).

3) Long-term hardening

• Adopt context-aware output encoding and strict input validation on all plugin REST handlers; do not rely solely on path-regex constraints given WP_REST_Request query precedence.
• Maintain a WordPress vulnerability-management cadence (plugin inventory + version tracking) and subscribe to NVD/WPScan advisories.
• Enable full request-logging and CSP to reduce XSS impact.

References

• NVD — CVE-2026-111601: https://nvd.nist.gov/vuln/detail/CVE-2026-111601
• MITRE CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• WordPress WP_REST_Request documentation (query vs. path parameter precedence): https://developer.wordpress.org/reference/classes/wp_rest_request/
• First EPSS (not yet scored at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data; CISA KEV status is NO and no public PoC/exploit code exists.