CVE-2024-6457: Husky WooCommerce Filter SQLi Vulnerability

CVE-2024-6457 Overview

CVE-2024-6457 is a time-based SQL injection vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. The flaw exists in the handling of the woof_author parameter across all versions up to and including 1.3.6. Insufficient escaping of user-supplied input and inadequate preparation of the underlying SQL statement allow unauthenticated attackers to append arbitrary SQL clauses to the existing query. Successful exploitation leads to extraction of sensitive data from the WordPress database, including user credentials, session tokens, and configuration values. The issue is categorized under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can exfiltrate sensitive database contents from affected WordPress sites by injecting SQL through the woof_author parameter.

Affected Products

HUSKY – Products Filter Professional for WooCommerce (Pluginus) versions ≤ 1.3.6
WordPress sites with the affected plugin installed and activated
WooCommerce stores using the author-based filtering extension

Discovery Timeline

2024-07-16 - CVE-2024-6457 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6457

Vulnerability Analysis

The vulnerability resides in the author-based filtering component of the HUSKY plugin, specifically within ext/by_author/index.php around line 102. The plugin accepts the woof_author parameter from HTTP requests and concatenates it into a SQL query without applying wpdb::prepare() or proper escaping through esc_sql(). Because the parameter is reachable without authentication, any visitor to a vulnerable site can craft requests that influence query execution.

The injection is time-based, meaning attackers infer database content by issuing payloads that conditionally delay responses through functions such as SLEEP() or BENCHMARK(). Repeated requests reconstruct sensitive values one character at a time. With an EPSS percentile above 97, automated scanners and opportunistic exploitation tooling are likely probing for this flaw across the public web.

Root Cause

The root cause is missing parameterization in the SQL query construction path. The plugin trusts the woof_author value supplied by the client and embeds it directly into the WHERE clause used to query authors. Without prepared statements or strict type casting, attackers control SQL syntax rather than supplying data.

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS against any page that triggers the HUSKY filter logic. The attacker submits a woof_author parameter containing SQL fragments and conditional time-delay functions. The server executes the modified query, and response timing reveals truthful conditions about the database state, allowing blind extraction of tables such as wp_users and wp_options.

No authentication, user interaction, or elevated privileges are required. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-6457

Indicators of Compromise

HTTP requests containing the woof_author parameter with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or AND 1=1
Anomalous response latency on WooCommerce category or shop pages correlating with woof_author query strings
Web server access logs showing repeated requests from a single source iterating over woof_author values
Unexpected database queries referencing wp_users or wp_usermeta originating from the plugin context

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for SQL metacharacters in the woof_author GET or POST parameter
Enable MySQL slow query logging to identify intentionally delayed queries used in time-based extraction
Deploy WordPress security plugins capable of signature-matching known HUSKY exploitation patterns
Correlate spikes in HTTP request volume against WooCommerce filter endpoints with subsequent database read anomalies

Monitoring Recommendations

Alert on sustained patterns of woof_author requests with response times exceeding normal baselines
Monitor outbound traffic from the WordPress host for unusual data egress following filter parameter abuse
Track plugin version inventory across managed WordPress instances to identify unpatched HUSKY deployments
Review WordPress audit logs for new administrator accounts or modified options following suspicious filter activity

How to Mitigate CVE-2024-6457

Immediate Actions Required

Update the HUSKY – Products Filter Professional for WooCommerce plugin to a version later than 1.3.6 immediately
Audit access logs for the period before patching to identify any historical exploitation attempts against woof_author
Rotate WordPress administrator passwords, database credentials, and secret keys defined in wp-config.php if exploitation is suspected
Place affected sites behind a WAF with rules blocking SQL metacharacters in plugin parameters until patching completes

Patch Information

The vendor addressed the issue in the plugin source tree via changeset 3116888. Site administrators should upgrade to the fixed release through the WordPress plugin dashboard or by replacing the plugin files manually. Verify the installed version reports greater than 1.3.6 after applying the update.

Workarounds

Disable and remove the HUSKY plugin until the patched version can be installed
Deploy WAF rules that reject requests containing SQL syntax such as SLEEP(, BENCHMARK(, or UNION SELECT within the woof_author parameter
Restrict access to WooCommerce filter endpoints by IP allowlist where feasible during the remediation window
Enable database user privilege separation so the WordPress MySQL account cannot read tables outside its required scope

bash

# Example WAF rule (ModSecurity) to block SQLi payloads in woof_author
SecRule ARGS:woof_author "@rx (?i)(sleep\(|benchmark\(|union\s+select|or\s+1=1|--\s)" \
    "id:1006457,phase:2,deny,status:403,log,msg:'CVE-2024-6457 HUSKY woof_author SQLi attempt'"