SQL Injection Vulnerability in HUSKY Products Filter Professional for WooCommerce Plugin

CVE-2024-6457

Summary

The HUSKY Products Filter Professional for WooCommerce plugin for WordPress is susceptible to a time-based SQL Injection vulnerability. This issue stems from insufficient escaping of the 'woof_author' parameter and inadequate preparation of the SQL query. As a result, an unauthenticated attacker can inject additional SQL queries into existing ones. This exploits the vulnerability to potentially extract sensitive information from the database, posing a significant security risk for users of this plugin.

References