CVE-2024-1795 Overview
CVE-2024-1795 is a SQL injection vulnerability [CWE-89] in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. The flaw resides in the name parameter of the woof shortcode. Insufficient escaping of user-supplied input and improper preparation of the underlying SQL query allow authenticated attackers with contributor-level access or higher to append additional SQL statements to existing queries. Successful exploitation permits extraction of sensitive data from the WordPress database. All plugin versions up to and including 1.3.5.2 are affected.
Critical Impact
Authenticated contributors can inject arbitrary SQL through the woof shortcode name parameter, exposing credentials, session tokens, and other sensitive database contents.
Affected Products
- Pluginus HUSKY – Products Filter Professional for WooCommerce, versions up to and including 1.3.5.2
- WordPress sites running the vulnerable plugin with contributor-level or higher user accounts
- WooCommerce deployments using the woof shortcode filter functionality
Discovery Timeline
- 2024-03-15 - CVE-2024-1795 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1795
Vulnerability Analysis
The vulnerability is a classic authenticated SQL injection in the plugin's shortcode handler. The woof shortcode accepts a name parameter that is concatenated into a SQL statement without sufficient sanitization or use of parameterized queries. Attackers holding contributor or higher privileges can craft shortcode input that terminates the intended SQL clause and appends arbitrary statements. The injected payload executes with the database privileges of the WordPress application user, typically granting full read access to the wp_users, wp_usermeta, and wp_options tables.
Contributor accounts are common on multi-author WordPress sites and are often subject to weaker registration controls than editor or administrator roles. This lowers the effective barrier to exploitation on sites that accept guest contributors or run open registration workflows.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The plugin passes the name shortcode attribute directly into a dynamically constructed query without invoking $wpdb->prepare() with proper placeholders or escaping the value with esc_sql(). Any single quote, comment sequence, or UNION keyword supplied by the attacker becomes part of the executed statement.
Attack Vector
Exploitation requires an authenticated session at contributor level or above. The attacker submits or previews content that renders the woof shortcode with a malicious name value. When the shortcode is processed, the injected SQL executes against the WordPress database. A UNION SELECT payload can extract data from arbitrary tables, including password hashes and API secrets stored in options. The attack is delivered over the network with low complexity and no user interaction beyond the attacker's own authenticated request. See the Wordfence Vulnerability Intelligence advisory for additional technical context.
Detection Methods for CVE-2024-1795
Indicators of Compromise
- Unexpected woof shortcode usage in posts or pages authored by contributor-level accounts.
- Web server access logs containing shortcode parameters with SQL keywords such as UNION, SELECT, SLEEP, or encoded quote characters.
- Database query logs showing malformed or unusually long queries referencing the plugin's filter tables.
- Unauthorized reads against wp_users or wp_usermeta from the WordPress application database user.
Detection Strategies
- Inspect all posts, pages, and custom post types for woof shortcodes containing suspicious name attribute values.
- Enable MySQL general query logging temporarily on staging systems to profile normal plugin queries and identify anomalies.
- Deploy a web application firewall rule that flags SQL metacharacters in shortcode parameters submitted by non-administrator accounts.
Monitoring Recommendations
- Alert on new contributor or author account creation followed by post drafts referencing filter shortcodes.
- Monitor for spikes in database error responses that may indicate blind SQL injection probing.
- Track outbound data volume from the WordPress host to detect bulk exfiltration following successful injection.
How to Mitigate CVE-2024-1795
Immediate Actions Required
- Update the HUSKY – Products Filter Professional for WooCommerce plugin to a version later than 1.3.5.2.
- Audit user roles and revoke contributor or higher privileges from accounts that do not require them.
- Rotate WordPress administrator passwords and any secrets stored in wp_options if compromise is suspected.
- Review recent post revisions and drafts for shortcodes containing SQL syntax.
Patch Information
The vendor addressed the vulnerability in a subsequent release tracked in the WordPress Plugin Changeset. The fix introduces proper input sanitization and prepared statement usage for the name parameter. Administrators should apply the update through the WordPress plugin manager and verify the installed version is above 1.3.5.2.
Workarounds
- Disable the HUSKY plugin until the patched version can be deployed if immediate updating is not feasible.
- Restrict contributor registration and disable open user registration in WordPress general settings.
- Deploy a WAF rule that blocks SQL keywords in shortcode attribute values submitted through the WordPress editor and REST API.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
