Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107646— HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

Quick assessment

Affected
realmag777 HUSKY – Products Filter for WooCommerce Professional
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"HUSKY – WooCommerce 专业版产品筛选器”插件在所有 1.4.5 及更早版本中存在敏感信息泄露漏洞。攻击者无需身份验证，即可通过 参数，从任意公开前端筛选页面中内嵌的 脚本对象提取外部 MySQL 主机地址、数据库名称、用户名以及明文密码。该漏洞仅在管理员同时启用“统计”扩展、保存了外部 MySQL 连接凭据并开启“Turbo 模式”时才可被利用；而上述三项配置均为该插件官方支持且已文档化的功能选项。

CVSS 5.3 · Medium EPSS 0.35% · P27

Affected Version Matrix 1

VendorProduct Version RangeStatus
realmag777 HUSKY – Products Filter for WooCommerce Professional ≤ 1.4.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107646

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
Source: CVE Program / CVE List V5
Vulnerability Description
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
realmag777 HUSKY – Products Filter for WooCommerce Professional 0 ~ 1.4.5 -

II. Public POCs for CVE-2026-107646

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107646

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-107646 (1)

Vendor Pages for CVE-2026-107646 (1)

IV. Related Vulnerabilities

Same product: HUSKY – Products Filter for WooCommerce Professional
Same vendor: realmag777
Same weakness: CWE-200

V. Comments for CVE-2026-107646

No comments yet

Leave a comment