---
id: "CVE-2026-116401"
kind: "vulnerability"
aliases: ["CVE-2026-116401"]
title: "HUSKY: unauthenticated broken access control in versions up to 1.4.6"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "woocommerce-products-filter (HUSKY)", "fixed": [], "affected": "<= 1.4.6", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["husky", "other", "woocommerce", "wordpress", "wordpress-plugin"]
not_affected_if: []
published_at: "2026-10-30T19:18:13+00:00"
first_seen_at: "2026-10-30T19:25:28+00:00"
updated_at: "2026-10-30T19:32:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116401", "first_seen_at": "2026-10-30T19:25:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:32:13+00:00"}]
---

# HUSKY: unauthenticated broken access control in versions up to 1.4.6

HUSKY is a WordPress/WooCommerce product-filter plugin (slug woocommerce-products-filter, formerly WOOF, by RealMag777, ~80,000 installs). Versions up to 1.4.6 have an unauthenticated broken access control flaw (CVSS 7.5, confidentiality impact only). The affected function is not named in the sources I could read, and no fixed version is stated.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:woocommerce-products-filter (HUSKY) affected <= 1.4.6 fixed ?

## How to check

In WordPress admin, open Plugins and check the HUSKY – Products Filter for WooCommerce version, or run: wp plugin get woocommerce-products-filter --field=version. 1.4.6 or lower is in the affected range.

## Timeline

- 2026-10-30T19:25:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116401
- 2026-10-30T19:32:13+00:00 analyst — Identified as the WordPress HUSKY plugin via a CVE aggregator (hol.org) and Patchstack's plugin page, since the CNA is Patchstack. The NVD page did not load and the Patchstack entry for this CVE was not found, so the affected endpoint and the fixed version are unknown. products-filter.com changelog says a release dated 2026-10-27 has security fixes, but that is under a different version scheme (3.4.7) and does not name this CVE. Settle it by reading the Patchstack entry for this CVE or the wp.org changelog. Nothing is marked verified. No exploitation reported.

## Documents

- [describes] HUSKY – Products Filter for WooCommerce (wordpress.org) https://wordpress.org/plugins/woocommerce-products-filter/
- [mentions] HUSKY vulnerability history - Patchstack https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerabilities
- [mentions] HUSKY changelog https://products-filter.com/changelog

## From the sources

Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_