Read the docs
TI-2026-75257 Aliases CVE-2026-107646GHSA-w4qc-rmgq-cc5g

Sensitive information exposure in HUSKY WooCommerce filter plugin

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The HUSKY (Products Filter for WooCommerce Professional) plugin for WordPress is affected in all versions up to and including 1.4.5. The plugin exposes sensitive information (CWE-200) by embedding the woof_settings[woof_stat][server_options] values in the inline woof_tm_data script. An unauthenticated remote attacker can read the external MySQL host, database name, username and plaintext password on any public frontend filter page, but only when the Statistics extension is enabled, external MySQL credentials are saved and Turbo Mode is enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
realmag777HUSKY – Products Filter for WooCommerce Professionalup to 1.4.5—No fix listedCNA
  • HUSKY – Products Filter for WooCommerce Professional Vendorrealmag777 Affected up to 1.4.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for HUSKY (Products Filter for WooCommerce Professional).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-107646
  2. 2026-10-16 Alias added: GHSA-w4qc-rmgq-cc5g

References

Other 6

  • TI-2025-01427 HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion CVSS 3.1CRITICAL 9.8
  • TI-2022-03728 InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE CVSS 3.1CRITICAL 9.8
  • TI-2024-33882 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-05993 HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-04104 WOOF - Products Filter for WooCommerce < 1.3.2 - Admin+ PHP Object Injection CVSS 3.1HIGH 7.2
  • TI-2023-13184 Cross-site scripting in InPost Gallery WordPress Plugin CVSS 3.1MEDIUM 5.4
See all 142 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences