CVE-2024-7491: HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woofmessengerremovesubscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7491?
CVE-2024-7491 has a medium severity rating due to the potential for unauthorized access to user data.
How do I fix CVE-2024-7491?
To fix CVE-2024-7491, update the HUSKY Products Filter Professional for WooCommerce plugin to version 1.3.6.2 or higher.
Who is affected by CVE-2024-7491?
Any user of the HUSKY Products Filter Professional for WooCommerce plugin in versions up to and including 1.3.6.1 is affected by CVE-2024-7491.
What is the nature of the vulnerability in CVE-2024-7491?
CVE-2024-7491 is an Insecure Direct Object Reference vulnerability that allows a user to manipulate user-controlled input to access unauthorized data.
When was CVE-2024-7491 disclosed?
CVE-2024-7491 was disclosed on October 2, 2024.