CVE-2025-13109 Overview
CVE-2025-13109 affects the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. All versions up to and including 1.3.7.2 contain an Insecure Direct Object Reference (IDOR) flaw in the woof_add_query and woof_remove_query functions. The functions accept a user-controlled key without validating ownership. Authenticated attackers with subscriber-level access can insert or remove arbitrary saved search queries in any user's profile, including administrator accounts. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Any authenticated user can tamper with saved search queries stored in other users' profiles, including administrators, enabling data manipulation across accounts.
Affected Products
- HUSKY – Products Filter Professional for WooCommerce plugin for WordPress
- All versions up to and including 1.3.7.2
- WordPress sites running WooCommerce with the affected plugin
Discovery Timeline
- 2025-12-03 - CVE-2025-13109 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13109
Vulnerability Analysis
The plugin exposes two AJAX-accessible functions, woof_add_query and woof_remove_query, that manage saved filter queries for WooCommerce shoppers. Both functions accept a key parameter that identifies the target user's saved query store. The code does not verify that the authenticated caller owns the referenced key. As a result, a subscriber-level account can supply any user identifier and manipulate that user's stored queries. Because administrators use the same storage mechanism, an attacker can inject or delete entries in an administrator profile without needing elevated privileges.
Root Cause
The root cause is missing authorization on a user-controlled parameter. The affected functions trust the client-supplied key rather than deriving the target identifier from the authenticated session. This pattern is the defining characteristic of CWE-639. The WordPress plugin changeset addresses the flaw by adding validation on the user context.
Attack Vector
Exploitation requires an authenticated account at subscriber level or higher, which is trivial on WordPress sites that allow open registration. The attacker sends a crafted AJAX request to the plugin endpoint, passing the target user identifier as the key. The plugin writes or removes saved query entries in the target profile without further checks. The vulnerability does not permit code execution or data theft, but it enables integrity impact on stored user data. See the Wordfence vulnerability report for advisory details.
Detection Methods for CVE-2025-13109
Indicators of Compromise
- Unexpected saved search queries appearing in administrator or editor user profiles.
- AJAX POST requests to admin-ajax.php invoking the woof_add_query or woof_remove_query actions from subscriber accounts.
- Requests where the user key parameter does not match the authenticated session user identifier.
Detection Strategies
- Review web server access logs for repeated calls to the plugin's AJAX handlers originating from low-privilege sessions.
- Compare the authenticated session cookie identity to the target user key in request bodies and flag mismatches.
- Audit the WordPress usermeta table for anomalous entries related to HUSKY saved queries.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and forward events to a centralized SIEM for correlation.
- Alert on subscriber-level accounts issuing plugin administrative actions.
- Track the WordPress plugin version inventory to identify hosts running vulnerable HUSKY builds.
How to Mitigate CVE-2025-13109
Immediate Actions Required
- Update the HUSKY – Products Filter Professional for WooCommerce plugin to the version that includes changeset 3400527 or later.
- Audit existing user profiles for unauthorized saved search queries and remove suspicious entries.
- Restrict new user registration or require administrator approval where possible.
Patch Information
The vendor addressed the flaw in the WordPress plugin repository through changeset 3400527. Site administrators should upgrade to a release later than 1.3.7.2. Additional advisory context is available in the Wordfence vulnerability report.
Workarounds
- Disable the HUSKY – Products Filter Professional plugin until the patched version is deployed.
- Block unauthenticated and low-privilege access to the affected AJAX actions through a web application firewall rule.
- Temporarily disable public user registration to reduce the pool of accounts that can reach the vulnerable functions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.