{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107646", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-10-08T14:20:11.106Z", "datePublished": "2026-10-16T06:40:59.675Z", "dateUpdated": "2026-10-16T14:52:03.331Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-10-16T06:40:59.675Z"}, "affected": [{"vendor": "realmag777", "product": "HUSKY \u2013 Products Filter for WooCommerce Professional", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HUSKY \u2013 Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode \u2014 all supported, documented plugin configurations."}], "title": "HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1186aca4-012b-4512-9ab3-166b9f84d725?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L187"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L177"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/stat/views/tabs_content.php#L292"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L93"}, {"url": "https://plugins.svn.wordpress.org/woocommerce-products-filter/trunk/ext/turbo_mode/index.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sawyer"}], "timeline": [{"time": "2026-10-08T14:35:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-10-15T17:35:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T14:51:55.869685Z", "id": "CVE-2026-107646", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T14:52:03.331Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HUSKY \u2013 Products Filter for WooCommerce Professional", "vendor": "realmag777", "versions": [{"lessThanOrEqual": "1.4.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HUSKY \u2013 Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode \u2014 all supported, documented plugin configurations."}], "id": "CVE-2026-107646", "lastModified": "2026-10-16T14:51:17.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2026-10-16T07:17:08.940", "references": [{"source": "[email protected]", "url": "https://plugins.svn.wordpress.org/woocommerce-products-filter/trunk/ext/turbo_mode/index.php"}, {"source": "[email protected]", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/stat/views/tabs_content.php#L292"}, {"source": "[email protected]", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L177"}, {"source": "[email protected]", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L187"}, {"source": "[email protected]", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L93"}, {"source": "[email protected]", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1186aca4-012b-4512-9ab3-166b9f84d725?source=cve"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "[email protected]", "type": "Primary"}]}

{}

{"created": "2026-10-16T13:24:50.165200+00:00", "updated": "2026-10-16T13:52:09.292922+00:00", "vendors": []}