Live › vulnerability › CVE-2026-107646
Go to dashboardThe HUSKY Products Filter for WooCommerce Professional plugin, up to and including 1.4.5, embeds saved external MySQL host, database name, username and plaintext password in the inline woof_tm_data script on public filter pages. An unauthenticated visitor can read these credentials from the page source.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the HUSKY Products Filter for WooCommerce Professional plugin at version 1.4.5 or earlier are exposed only when the Statistics extension is enabled, external MySQL credentials are saved, and Turbo Mode is on. Sites that do not use the external statistics database, or that run a newer version, can skip it.
No product ranges from the sources yet.
1.4.5 and below are affected.woof_tm_data to see whether server_options appears.1.4.5; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
This page as .md · .json · in your agent: get_signal("CVE-2026-107646")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.