---
id: "CVE-2026-107646"
kind: "vulnerability"
aliases: ["CVE-2026-107646"]
title: "WordPress HUSKY WooCommerce filter plugin leaks external MySQL credentials publicly"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["default-config", "newer-version"]
published_at: "2026-10-16T07:17:08+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107646", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress HUSKY WooCommerce filter plugin leaks external MySQL credentials publicly

The HUSKY Products Filter for WooCommerce Professional plugin, up to and including 1.4.5, embeds saved external MySQL host, database name, username and plaintext password in the inline woof_tm_data script on public filter pages. An unauthenticated visitor can read these credentials from the page source.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the HUSKY – Products Filter for WooCommerce Professional plugin in the WordPress admin plugins list; versions `1.4.5` and below are affected.
- In plugin settings, check whether the Statistics extension is enabled, external MySQL credentials are saved, and Turbo Mode is on.
- View the source of a public shop filter page and search for `woof_tm_data` to see whether `server_options` appears.

## Fix

- Update the HUSKY – Products Filter for WooCommerce Professional plugin to a version newer than `1.4.5`; the sources do not name the fixed version.
- Change the external MySQL password for the database stored in the plugin settings, since it was exposed in page source.
- Disable Turbo Mode or the Statistics extension if an update is not available yet.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107646

## From the sources

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_