{"vulnerability": "CVE-2026-10580", "sightings": [{"uuid": "e1740cbf-df6e-4fa5-81d8-a1d1a8c57a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mnldv3nnpv2c", "content": "CVE-2026-10580. CVSS 9.8. Hippoo Mobile App for WooCommerce lets any visitor take over admin accounts. No authentication required. Update to 1.9.4 now. Scan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "creation_timestamp": "2026-06-06T00:00:12.942192Z"}, {"uuid": "0e161c6e-6b86-419b-a05c-46827e3e1a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwkmd32g2p", "content": "\ud83d\udd34 CVE-2026-10580 - Critical (9.8)\n\nThe Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-10580/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-05T20:01:43.987860Z"}, {"uuid": "a2cc85d3-ae1c-4675-908b-ec1755bcdc17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mnpdq65dfl2s", "content": "CVE-2026-10580 - Critical Authentication Bypass in Hippoo WordPress plugin. Flaw conflates admin and unauthenticated user permissions, allowing full admin takeover. CVSS 9.8. No patch available. Disable plugin now. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-10580/", "creation_timestamp": "2026-06-07T14:08:08.097746Z"}, {"uuid": "45e0fd84-668c-4bac-9106-7072019098f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-10580.yaml", "content": "", "creation_timestamp": "2026-06-10T19:03:51.000000Z"}, {"uuid": "78a4603b-61f0-458d-b7d4-b326929cb7a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mobwuu7fg32p", "content": "\ud83d\udea8  ALERT: CVE-2026-10580\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nThe Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user", "creation_timestamp": "2026-06-14T23:38:40.455954Z"}, {"uuid": "20d4376f-5c63-489c-b876-74bc8779bae0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mobyxswlxa25", "content": "CVE-2026-10580 hippoo (CVSS Score 9.8) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-06-15T00:16:07.670995Z"}, {"uuid": "1bef1b1e-2886-4f63-81e5-a1d23a8579a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "Telegram/LhIaoh3_gVTYhhCtIaB2hHXuGQagt5GRqp2XlP3YfDwVpSU", "content": "", "creation_timestamp": "2026-06-06T21:00:04.000000Z"}, {"uuid": "9bbfd235-7039-4347-8875-6ad05d5ec65d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "https://t.me/GithubRedTeam/91265", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10580\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 09:31:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-10580 - Authentication Bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 leading to Admin Account Takeover\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:16.778536Z"}, {"uuid": "2e68967f-1c6a-4900-868b-c4d1168c7c36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91265", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-10580\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 09:31:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-10580 - Authentication Bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 leading to Admin Account Takeover\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:24.444721Z"}, {"uuid": "4328496b-44f0-4762-94fe-21fd91857a86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-16T19:00:26.416410Z"}, {"uuid": "7e03262b-4b3d-4ddd-9fbc-d1183fe527a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "seen", "source": "Telegram/PPrzS3gz9qQLgzr1WoRl3iwYb9bYPZPQYF8TcZKF9BE1m-w", "content": "", "creation_timestamp": "2026-07-16T19:00:26.751824Z"}, {"uuid": "95462096-1603-4c07-be9a-17c97e468dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "Telegram/PPrzS3gz9qQLgzr1WoRl3iwYb9bYPZPQYF8TcZKF9BE1m-w", "content": "", "creation_timestamp": "2026-07-18T00:00:08.182692Z"}, {"uuid": "ca758fff-64ec-4d6f-9c43-4c4a12af4d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10580", "type": "published-proof-of-concept", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-18T00:00:08.795908Z"}, {"uuid": "7374ac1a-373c-4bc2-95a4-328d3fad0676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105801", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gaywtg2rtkp3p", "content": "CVE-2026-105801 - openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation\nCVE ID : CVE-2026-105801\n \n Published : Oct. 6, 2026, 2:53 p.m. | 21\u00a0minutes ago\n \n Description : openapi-python-client generates Python clients from OpenAPI documents. Pri...", "creation_timestamp": "2026-10-06T16:19:37.413465Z"}, {"uuid": "1ee695fa-3c1b-4775-b6aa-151f6a49ce41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105804", "type": "seen", "source": "https://gist.github.com/alon710/c52a2dba732474335a8df3272884df93", "content": "# CVE-2026-105804: CVE-2026-105804: Insecure Default PBKDF2 Password Hashing Configuration in Payload CMS\n\n> **CVSS Score:** 5.7\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105804\n\n## Summary\nPayload CMS was discovered to use an insecure default configuration for its password-hashing mechanism. The system requested a 512-byte key from PBKDF2-HMAC-SHA256 with 25,000 iterations, creating a severe cryptographic asymmetry. While the defending server sequentially computed 16 blocks of key material (equivalent to 400,000 internal iterations), an offline attacker only needed to compute the first 32-byte block to verify password guesses. This allowed offline attackers to crack stolen database hashes 16 times faster than intended by the security design.\n\n## TL;DR\nPayload CMS utilized a PBKDF2 configuration that requested a 512-byte output length. Because SHA-256 produces 32-byte blocks, the server performed 16x more work than necessary, whereas offline attackers could skip 15 of those blocks to verify guesses, granting them a 16x speedup advantage.\n\n## Technical Details\n\n- **CWE ID**: CWE-916\n- **Attack Vector**: Local\n- **CVSS v4 Score**: 5.7 (Medium)\n- **EPSS Score**: Not listed\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS (payload) installations between versions 3.0.0 and 3.90.0\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to patched versions immediately.\n- Enforce strict multi-factor authentication (MFA) to minimize the impact of cracked credentials.\n- Ensure robust access controls and encryption on database backups.\n\n**Remediation Steps:**\n1. Update package.json dependencies to target payload versions >= 3.90.0.\n2. Run the package manager update command (e.g., npm update payload or yarn upgrade payload).\n3. Deploy the updated application to production environments.\n4. Monitor application logs for successful opportunistic password upgrades during user sign-ins.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm)\n- [Official Release Announcement (v3.90.0)](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105804) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T16:30:31.000000Z"}, {"uuid": "3a8ae588-0aed-4090-950f-8231b9505df9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105800", "type": "published-proof-of-concept", "source": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf", "content": "", "creation_timestamp": "2026-09-02T21:13:16.000000Z"}, {"uuid": "9fe0c3f6-9271-4dc6-b6b4-9cc613a8476a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105806", "type": "seen", "source": "https://gist.github.com/alon710/20c58cb4d07d11bc54a823c67d892ac1", "content": "# CVE-2026-105806: CVE-2026-105806: Privilege Escalation and Missing Authorization in @payloadcms/plugin-mcp\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105806\n\n## Summary\nCVE-2026-105806 is an improper access control vulnerability within the Model Context Protocol (MCP) plugin for Payload CMS. Authenticated users with low privileges can manipulate API key creation and mapping to associate keys with arbitrary users, including administrators. This allows total session takeovers and privilege escalation via MCP-authenticated API requests.\n\n## TL;DR\nA missing authorization check in @payloadcms/plugin-mcp allows authenticated low-privilege users to generate MCP API keys mapped to administrative accounts, resulting in privilege escalation and full account takeover.\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.6\n- **Exploit Status**: Unproven / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS\n- @payloadcms/plugin-mcp\n- **@payloadcms/plugin-mcp**: >= 3.61.0, < 3.88.0 (Fixed in: `3.88.0`)\n\n## Mitigation\n\n- Upgrade @payloadcms/plugin-mcp to version 3.88.0 or higher.\n- Disable the MCP plugin if it is not actively required.\n- Manually override collection permissions using overrideApiKeyCollection hook.\n\n**Remediation Steps:**\n1. Verify the current version of @payloadcms/plugin-mcp in package.json.\n2. Run npm install @payloadcms/plugin-mcp@3.88.0 or yarn upgrade.\n3. Deploy the updated code and restart the Payload CMS service.\n\n## References\n\n- [GitHub Security Advisory GHSA-2q76-m6w6-qgc6](https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6)\n- [Official Patch Commit](https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1)\n- [Release v3.88.0](https://github.com/payloadcms/payload/releases/tag/v3.88.0)\n- [CVE-2026-105806 Record](https://www.cve.org/CVERecord?id=CVE-2026-105806)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105806) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T02:30:32.000000Z"}, {"uuid": "05074db8-a990-49c5-80d5-8575cd6f019d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105805", "type": "seen", "source": "https://gist.github.com/alon710/4680e98ffa333160aba737ae967e8686", "content": "# CVE-2026-105805: CVE-2026-105805: Sorting-Based Side-Channel Information Disclosure in Payload CMS\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105805\n\n## Summary\nCVE-2026-105805 is an authorization bypass and information disclosure vulnerability in Payload CMS. Before version 3.88.0, user-controlled sorting was executed at the database level before field-level access control rules and data redaction were applied. This allowed unauthorized users to reconstruct restricted field values through a sorting side-channel.\n\n## TL;DR\nAn authorization bypass vulnerability in Payload CMS enables unauthenticated users to deduce hidden values in restricted fields (such as passphrases, tokens, or boolean flags) by leveraging sorting parameters to alter the physical order of returned API records.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 / CWE-200\n- **Attack Vector**: Network\n- **CVSS Score**: 6.9 (Medium)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Type**: Incorrect Authorization (Sorting Side-Channel)\n\n## Affected Systems\n\n- Payload CMS\n- **Payload CMS**: < 3.88.0 (Fixed in: `3.88.0`)\n- **Payload CMS**: >= 4.0.0-canary.0, < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to v3.88.0 or v4.0.0-canary.27 immediately.\n- Deploy custom Express or application middleware to inspect and sanitize HTTP query sort parameters.\n- Hardcode default sort parameters on critical collections to disable user-controlled sorting inputs on sensitive endpoints.\n\n**Remediation Steps:**\n1. Identify the current installation version of Payload CMS in package.json.\n2. Execute dependency upgrade instructions to pull down version 3.88.0 or above.\n3. Review custom access control logic in schema definitions to ensure restricted fields are properly configured.\n4. Enable query-level logging on database systems to verify query parameters are properly verified before processing.\n\n## References\n\n- [Official GitHub Advisory GHSA-9g87-32v6-3c2r](https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r)\n- [Core Mitigation Implementation Patch](https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a)\n- [Payload CMS v3.88.0 Official Release Changelog](https://github.com/payloadcms/payload/releases/tag/v3.88.0)\n- [NVD Vulnerability Details Reference Page](https://nvd.nist.gov/vuln/detail/CVE-2026-105805)\n- [Official CVE.org Record Details](https://www.cve.org/CVERecord?id=CVE-2026-105805)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105805) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T07:30:30.000000Z"}]}