{"id":"CVE-2026-116401","kind":"vulnerability","aliases":["CVE-2026-116401"],"related":[],"title":"HUSKY: unauthenticated broken access control in versions up to 1.4.6","description":"Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.","summary":"HUSKY is a WordPress/WooCommerce product-filter plugin (slug woocommerce-products-filter, formerly WOOF, by RealMag777, ~80,000 installs). Versions up to 1.4.6 have an unauthenticated broken access control flaw (CVSS 7.5, confidentiality impact only). The affected function is not named in the sources I could read, and no fixed version is stated.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"woocommerce-products-filter (HUSKY)","fixed":[],"affected":"<= 1.4.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["husky","other","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":[],"how_to_check":"In WordPress admin, open Plugins and check the HUSKY – Products Filter for WooCommerce version, or run: wp plugin get woocommerce-products-filter --field=version. 1.4.6 or lower is in the affected range.","fix":null,"status":"open","published_at":"2026-10-30T19:18:13+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:25:57+00:00","updated_at":"2026-10-30T19:32:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T19:25:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HUSKY: unauthenticated broken access control in versions up to 1.4.6","impact":"medium","summary":"HUSKY versions 1.4.6 and earlier have a broken access control flaw that needs no login. The sources do not say what an attacker can reach or change.","audience":"developers","category":"other","nicknames":[],"who_cares":["husky"],"confidence":0.3,"fix_status":"unknown","needs_auth":"no","worst_case":"unknown access to protected functions without login","analyst_note":"Identify what HUSKY is (the sources do not name the product's ecosystem) and which endpoints or features the access control covers; check https://nvd.nist.gov/vuln/detail/CVE-2026-116401 for details and a fixed version.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000587,"input_tokens":4050,"output_tokens":364,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify what HUSKY is (the sources do not name the product's ecosystem) and which endpoints or features the access control covers; check https://nvd.nist.gov/vuln/detail/CVE-2026-116401 for details and a fixed version.","search":"'-116401':13A,16A '-2026':12A,15A '000':47B '1.4.6':10A,52B,89C '7.5':61B '80':46B 'access':4A,57B,85C 'affect':66B 'broken':3A,56B,84C 'confidenti':62B 'control':5A,58B,86C 'could':75B 'cve':11A,14A 'cvss':60B 'filter':20A,35B,41B 'fix':79B 'flaw':59B 'former':42B 'function':67B 'huski':1A,22B,29B,88C 'husky':21A 'impact':63B 'instal':48B 'name':70B 'plugin':28B,36B 'product':34B,40B 'product-filt':33B 'products':19A 'read':76B 'realmag777':45B 'slug':37B 'sourc':73B 'state':82B 'unauthent':2A,55B,83C 'version':7A,49B,80B,90C 'woocommerc':24B,39B 'woocommerce':18A 'woocommerce-products-filt':38B 'woocommerce-products-filter':17A 'woof':43B 'wordpress':25B,27B 'wordpress-plugin':26B 'wordpress/woocommerce':32B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the HUSKY – Products Filter for WooCommerce plugin at version 1.4.6 or earlier. Anyone on the internet can trigger it without logging in, and the CVSS vector points to data disclosure rather than changes. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T19:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116401","severity":null,"published_at":"2026-10-30T19:18:13+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116401:1198","url":null,"severity":null,"published_at":"2026-10-30T19:32:13+00:00","modified_at":"2026-10-30T19:32:13+00:00","first_seen_at":"2026-10-30T19:32:13+00:00","fetched_at":"2026-10-30T19:32:13+00:00","note":"Identified as the WordPress HUSKY plugin via a CVE aggregator (hol.org) and Patchstack's plugin page, since the CNA is Patchstack. The NVD page did not load and the Patchstack entry for this CVE was not found, so the affected endpoint and the fixed version are unknown. products-filter.com changelog says a release dated 2026-10-27 has security fixes, but that is under a different version scheme (3.4.7) and does not name this CVE. Settle it by reading the Patchstack entry for this CVE or the wp.org changelog. Nothing is marked verified. No exploitation reported."}],"documents":[{"id":25523,"url":"https://wordpress.org/plugins/woocommerce-products-filter/","title":"HUSKY – Products Filter for WooCommerce (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":25524,"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerabilities","title":"HUSKY vulnerability history - Patchstack","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":25525,"url":"https://products-filter.com/changelog","title":"HUSKY changelog","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}