CVE-2026-107646: HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

Q: Which deployments are exposed?

Exposure requires all three conditions: the Statistics extension is enabled, external MySQL credentials have been saved in its server options, and Turbo Mode is enabled. A public frontend page that displays the plugin's filter must also be accessible to the attacker.

Q: Does an attacker need an account or interaction from a victim?

No. The issue is exploitable remotely without authentication or user interaction because the credentials can be read from the inline woof_tm_data script object on a public filter page.

Q: What information can be disclosed?

An attacker can extract the external MySQL host, database name, username, and plaintext password stored in the configured server options.

Q: What can be done if updating is not immediately possible?

Disable Turbo Mode, disable the Statistics extension, or remove the saved external MySQL connection credentials. These configuration conditions are required for exploitation.

Q: How can administrators check whether they are affected?

Review whether the site runs version 1.4.5 or earlier and has Statistics enabled, external MySQL credentials saved, and Turbo Mode enabled. If those conditions apply, inspect a public frontend filter page for an inline woof_tm_data script object containing the server options.

Published Oct 16, 2026

Updated

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettings[woofstat][serveroptions]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woofsettings[woofstat][serveroptions] from the inline wooftmdata script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

Affected Software

1 affected component

HUSKY Products Filter for WooCommerce Professional<=1.4.5

Event History

Oct 16, 2026

CVE Published

via MITRE·06:40 AM

Data Sourced

via MITRE·06:40 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Exposure requires all three conditions: the Statistics extension is enabled, external MySQL credentials have been saved in its server options, and Turbo Mode is enabled. A public frontend page that displays the plugin's filter must also be accessible to the attacker.

Does an attacker need an account or interaction from a victim?

No. The issue is exploitable remotely without authentication or user interaction because the credentials can be read from the inline woof_tm_data script object on a public filter page.

What information can be disclosed?

An attacker can extract the external MySQL host, database name, username, and plaintext password stored in the configured server options.

What can be done if updating is not immediately possible?

Disable Turbo Mode, disable the Statistics extension, or remove the saved external MySQL connection credentials. These configuration conditions are required for exploitation.

How can administrators check whether they are affected?

Review whether the site runs version 1.4.5 or earlier and has Statistics enabled, external MySQL credentials saved, and Turbo Mode enabled. If those conditions apply, inspect a public frontend filter page for an inline woof_tm_data script object containing the server options.

CVE-2026-107646: HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need an account or interaction from a victim?

What information can be disclosed?

What can be done if updating is not immediately possible?

How can administrators check whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need an account or interaction from a victim?

What information can be disclosed?

What can be done if updating is not immediately possible?

How can administrators check whether they are affected?