CVE-2026-10580: Hippoo Admin Account Takeover via REST API (CVSS 9.8)

CVE-2026-10580 (CVSS 9.8): critical auth bypass in Hippoo WooCommerce plugin lets unauthenticated attackers reset any user password and take over the site.