{"vulnerability": "CVE-2026-10580", "sightings": [{"uuid": "e1740cbf-df6e-4fa5-81d8-a1d1a8c57a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnldv3nnpv2c", "content": "CVE-2026-10580. CVSS 9.8. Hippoo Mobile App for WooCommerce lets any visitor take over admin accounts. No authentication required. Update to 1.9.4 now. Scan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "creation_timestamp": "2026-06-06T00:00:12.942192Z"}, {"uuid": "0e161c6e-6b86-419b-a05c-46827e3e1a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwkmd32g2p", "content": "\ud83d\udd34 CVE-2026-10580 - Critical (9.8)\n\nThe Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-10580/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-05T20:01:43.987860Z"}, {"uuid": "a2cc85d3-ae1c-4675-908b-ec1755bcdc17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mnpdq65dfl2s", "content": "CVE-2026-10580 - Critical Authentication Bypass in Hippoo WordPress plugin. Flaw conflates admin and unauthenticated user permissions, allowing full admin takeover. CVSS 9.8. No patch available. Disable plugin now. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-10580/", "creation_timestamp": "2026-06-07T14:08:08.097746Z"}, {"uuid": "45e0fd84-668c-4bac-9106-7072019098f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-10580.yaml", "content": "", "creation_timestamp": "2026-06-10T19:03:51.000000Z"}, {"uuid": "78a4603b-61f0-458d-b7d4-b326929cb7a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mobwuu7fg32p", "content": "\ud83d\udea8  ALERT: CVE-2026-10580\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nThe Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user", "creation_timestamp": "2026-06-14T23:38:40.455954Z"}, {"uuid": "20d4376f-5c63-489c-b876-74bc8779bae0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mobyxswlxa25", "content": "CVE-2026-10580 hippoo (CVSS Score 9.8) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-06-15T00:16:07.670995Z"}, {"uuid": "1bef1b1e-2886-4f63-81e5-a1d23a8579a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "Telegram/LhIaoh3_gVTYhhCtIaB2hHXuGQagt5GRqp2XlP3YfDwVpSU", "content": "", "creation_timestamp": "2026-06-06T21:00:04.000000Z"}, {"uuid": "9bbfd235-7039-4347-8875-6ad05d5ec65d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://t.me/GithubRedTeam/91265", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10580\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 09:31:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-10580 - Authentication Bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 leading to Admin Account Takeover\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:16.778536Z"}, {"uuid": "f9138b46-d442-478a-b3f8-1479a7ae2ac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://t.me/GithubRedTeam/91265", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10580\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 09:31:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-10580 - Authentication Bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 leading to Admin Account Takeover\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:33.342100Z"}, {"uuid": "2e68967f-1c6a-4900-868b-c4d1168c7c36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91265", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10580\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 09:31:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-10580 - Authentication Bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 leading to Admin Account Takeover\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:24.444721Z"}, {"uuid": "4328496b-44f0-4762-94fe-21fd91857a86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-16T19:00:26.416410Z"}, {"uuid": "7e03262b-4b3d-4ddd-9fbc-d1183fe527a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "Telegram/PPrzS3gz9qQLgzr1WoRl3iwYb9bYPZPQYF8TcZKF9BE1m-w", "content": "", "creation_timestamp": "2026-07-16T19:00:26.751824Z"}, {"uuid": "1fc34859-d67c-450e-8b0b-2de0bd770831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-17T00:00:42.736395Z"}, {"uuid": "97d4a322-afb7-42b5-906c-af430e51314a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "Telegram/PPrzS3gz9qQLgzr1WoRl3iwYb9bYPZPQYF8TcZKF9BE1m-w", "content": "", "creation_timestamp": "2026-07-17T00:00:43.155028Z"}, {"uuid": "95462096-1603-4c07-be9a-17c97e468dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "Telegram/PPrzS3gz9qQLgzr1WoRl3iwYb9bYPZPQYF8TcZKF9BE1m-w", "content": "", "creation_timestamp": "2026-07-18T00:00:08.182692Z"}, {"uuid": "ca758fff-64ec-4d6f-9c43-4c4a12af4d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-18T00:00:08.795908Z"}]}