Live › vulnerability › CVE-2026-116401
HUSKY is a WordPress/WooCommerce product-filter plugin (slug woocommerce-products-filter, formerly WOOF, by RealMag777, ~80,000 installs). Versions up to 1.4.6 have an unauthenticated broken access control flaw (CVSS 7.5, confidentiality impact only). The affected function is not named in the sources I could read, and no fixed version is stated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
WordPress sites running the HUSKY – Products Filter for WooCommerce plugin at version 1.4.6 or earlier. Anyone on the internet can trigger it without logging in, and the CVSS vector points to data disclosure rather than changes. Sites without this plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| woocommerce-products-filter (HUSKY) | wordpress | <= 1.4.6 | – |
In WordPress admin, open Plugins and check the HUSKY – Products Filter for WooCommerce version, or run: wp plugin get woocommerce-products-filter --field=version. 1.4.6 or lower is in the affected range.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116401")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.