{"id":"CVE-2026-107646","kind":"vulnerability","aliases":["CVE-2026-107646"],"related":[],"title":"WordPress HUSKY WooCommerce filter plugin leaks external MySQL credentials publicly","description":"The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.","summary":"The HUSKY Products Filter for WooCommerce Professional plugin, up to and including 1.4.5, embeds saved external MySQL host, database name, username and plaintext password in the inline woof_tm_data script on public filter pages. An unauthenticated visitor can read these credentials from the page source.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["default-config","newer-version"],"how_to_check":"- Check the installed version of the HUSKY – Products Filter for WooCommerce Professional plugin in the WordPress admin plugins list; versions `1.4.5` and below are affected.\n- In plugin settings, check whether the Statistics extension is enabled, external MySQL credentials are saved, and Turbo Mode is on.\n- View the source of a public shop filter page and search for `woof_tm_data` to see whether `server_options` appears.","fix":"- Update the HUSKY – Products Filter for WooCommerce Professional plugin to a version newer than `1.4.5`; the sources do not name the fixed version.\n- Change the external MySQL password for the database stored in the plugin settings, since it was exposed in page source.\n- Disable Turbo Mode or the Statistics extension if an update is not available yet.","status":"open","published_at":"2026-10-16T07:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:39+00:00","updated_at":"2026-10-25T04:28:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:28:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the HUSKY – Products Filter for WooCommerce Professional plugin to a version newer than `1.4.5`; the sources do not name the fixed version.\n- Change the external MySQL password for the database stored in the plugin settings, since it was exposed in page source.\n- Disable Turbo Mode or the Statistics extension if an update is not available yet.","reach":"internet","title":"WordPress HUSKY WooCommerce filter plugin leaks external MySQL credentials publicly","impact":"medium","summary":"The HUSKY Products Filter for WooCommerce Professional plugin, up to and including 1.4.5, embeds saved external MySQL host, database name, username and plaintext password in the inline woof_tm_data script on public filter pages. An unauthenticated visitor can read these credentials from the page source.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attackers read external database host, username and plaintext password from public pages","analyst_note":"","how_to_check":"- Check the installed version of the HUSKY – Products Filter for WooCommerce Professional plugin in the WordPress admin plugins list; versions `1.4.5` and below are affected.\n- In plugin settings, check whether the Statistics extension is enabled, external MySQL credentials are saved, and Turbo Mode is on.\n- View the source of a public shop filter page and search for `woof_tm_data` to see whether `server_options` appears.","needs_analyst":false,"not_affected_if":["default-config","newer-version"],"who_is_affected":"Sites running the HUSKY Products Filter for WooCommerce Professional plugin at version 1.4.5 or earlier are exposed only when the Statistics extension is enabled, external MySQL credentials are saved, and Turbo Mode is on. Sites that do not use the external statistics database, or that run a newer version, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":3457,"output_tokens":710,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107646':13A,16A '-2026':12A,15A '1.4.5':35B,92C 'administr':149C 'attack':108C 'configur':168C 'connect':158C 'credenti':9A,64B,159C 'cve':11A,14A 'data':52B,134C 'databas':41B,115C 'document':166C 'emb':36B 'enabl':151C,161C 'exploit':146C 'exposur':84C 'extens':154C 'extern':7A,38B,112C,156C 'extract':110C 'filter':4A,26B,56B,72C,141C 'frontend':140C 'host':20B,40B,114C 'huski':2A,24B,70C 'includ':34B,91C 'inform':83C 'inlin':49B,131C 'leak':6A 'make':103C 'mode':163C 'mysql':8A,39B,113C,157C 'name':42B,116C 'object':136C 'option':100C,128C 'packag':17B 'page':57B,67B,142C 'paramet':101C 'password':46B,120C 'plaintext':45B,119C 'plugin':5A,30B,76C,167C 'possibl':105C 'product':25B,71C 'profession':29B,75C 'public':10A,55B,139C 'read':62B 'save':37B,155C 'script':53B,135C 'self':19B 'self-host':18B 'sensit':82C 'server':99C,127C 'set':96C,124C 'sourc':68B 'stat':98C,126C 'statist':153C 'store':121C 'support':165C 'tm':51B,133C 'turbo':162C 'unauthent':59B,107C 'usernam':43B,117C 'version':87C 'via':93C 'visitor':60B 'vulner':80C 'woocommerc':3A,21B,28B,74C 'woof':50B,95C,97C,123C,125C,132C 'wordpress':1A,22B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the HUSKY Products Filter for WooCommerce Professional plugin at version 1.4.5 or earlier are exposed only when the Statistics extension is enabled, external MySQL credentials are saved, and Turbo Mode is on. Sites that do not use the external statistics database, or that run a newer version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107646","severity":null,"published_at":"2026-10-16T07:17:08+00:00","modified_at":"2026-10-16T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}