CVE-2025-13109: HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woofaddquery" and "woofremovequery" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13109?
CVE-2025-13109 is classified as a medium severity vulnerability due to its potential for exploitation through Insecure Direct Object References.
How do I fix CVE-2025-13109?
To fix CVE-2025-13109, update the HUSKY Products Filter Professional for WooCommerce plugin to the latest version beyond 1.3.7.2.
What functions are affected by CVE-2025-13109?
CVE-2025-13109 affects the "woof_add_query" and "woof_remove_query" functions within the plugin.
Who is affected by CVE-2025-13109?
All users of the HUSKY Products Filter Professional for WooCommerce plugin up to version 1.3.7.2 are affected by CVE-2025-13109.
What does CVE-2025-13109 exploit?
CVE-2025-13109 exploits missing validation on a user-controlled key, leading to Insecure Direct Object Reference vulnerabilities.