CVE-2026-107646
Received Received - Intake

Sensitive Information Exposure in HUSKY Products Filter for WooCommerce

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-107646
EUVD
EUVD-2026-102783

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
realmag777 HUSKY – Products Filter for WooCommerce Professional 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the HUSKY – Products Filter for WooCommerce Professional plugin allows unauthenticated attackers to access sensitive database credentials. The issue occurs when the plugin's Statistics extension is enabled with external MySQL connection settings and Turbo Mode is active. Attackers can extract the MySQL host, database name, username, and plaintext password from a frontend page.

Detection Guidance

Check WordPress sites using the HUSKY – Products Filter for WooCommerce Professional plugin up to version 1.4.5. Inspect frontend filter pages for inline woof_tm_data script objects containing external MySQL credentials. Look for exposed parameters like woof_settings[woof_stat][server_options].

Impact Analysis

If exploited, attackers could gain access to your WordPress site's database, potentially leading to data theft, unauthorized modifications, or further attacks. This includes accessing customer data, product information, or other sensitive details stored in the database.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health-related data. Organizations may face legal penalties, reputational damage, and loss of customer trust due to data breaches.

Mitigation Strategies
  • Update the HUSKY plugin to the latest version beyond 1.4.5 to patch the vulnerability.
  • Disable the Statistics extension if external MySQL credentials are not required.
  • Disable Turbo Mode if it is enabled in the plugin settings.
  • Rotate all exposed MySQL credentials immediately if they were stored in the vulnerable configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart