CVE-2026-107646
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress in versions up to and including 1.4.5 is vulnerable to Sensitive Information Exposure via the 'woof_settings[woof_stat][server_options]' parameter. Unauthenticated attackers can extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on any public frontend filter page.
Risk Assessment
Leakage of external MySQL credentials may allow an attacker to directly access the database and steal or modify data. The vulnerability is exploitable without authentication when the administrator has enabled the Statistics extension and Turbo Mode.
Recommendation
Update the plugin to a version later than 1.4.5; if not possible, disable the Statistics extension and Turbo Mode and rotate the external MySQL credentials.
Other vulnerabilities in HUSKY – Products Filter for WooCommerce Professional
Original NVD description (English source)
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS