Sensitive Information Exposure in HUSKY – Products Filter for WooCommerce Professional Plugin by WordPress

CVE-2026-107646

What is CVE-2026-107646?

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress contains a vulnerability that exposes sensitive information, including MySQL connection parameters, to unauthenticated attackers. This issue exists in all versions up to 1.4.5 through the 'woof_settings[woof_stat][server_options]' parameter when specific plugin configurations are in place, such as enabling the Statistics extension and Turbo Mode. Attackers can exploit this vulnerability to access critical database information stored in plaintext, thus posing a significant risk to the integrity of the site.

References