CVE-2026-107646: HUSKY WooCommerce Filter Information Disclosure

CVE-2026-107646 Overview

CVE-2026-107646 is a sensitive information exposure vulnerability [CWE-200] in the HUSKY – Products Filter for WooCommerce Professional plugin for WordPress. The flaw affects all versions up to and including 1.4.5. Unauthenticated attackers can extract external MySQL connection credentials from the woof_settings[woof_stat][server_options] parameter rendered inside the inline woof_tm_data JavaScript object on any public frontend filter page. Exposed data includes the external MySQL host, database name, username, and plaintext password. The condition is only reachable when an administrator enables the Statistics extension, saves external MySQL connection credentials, and enables Turbo Mode.

Critical Impact
Unauthenticated remote attackers can harvest plaintext external database credentials by requesting any public page that renders the HUSKY filter widget.

Affected Products

HUSKY – Products Filter for WooCommerce Professional plugin for WordPress
All plugin versions up to and including 1.4.5
WordPress sites running the Statistics extension with Turbo Mode enabled and external MySQL credentials configured

Discovery Timeline

2026-10-16 - CVE-2026-107646 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107646

Vulnerability Analysis

The HUSKY – Products Filter plugin ships a Statistics extension and a Turbo Mode feature. When both are enabled, the plugin serializes configuration values from the woof_settings option into an inline JavaScript object called woof_tm_data. This object is emitted on any public frontend page that renders the product filter widget. The serialization includes the woof_stat.server_options sub-array, which stores the external MySQL host, database name, username, and plaintext password used by the Statistics extension to write analytics data to a separate database. Because the output is embedded in the page HTML before any authentication check, any unauthenticated visitor can view the page source and read the credentials.

Root Cause

The root cause is improper separation between server-side configuration data and client-side rendering context. The plugin treats the entire woof_settings option as safe to inject into inline JavaScript without filtering sensitive sub-keys such as woof_stat.server_options. No access control or scrubbing routine redacts the credential fields before output. This maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to a publicly reachable page that renders the filter. An attacker requests any frontend URL containing the HUSKY filter widget, retrieves the HTML response, and parses the woof_tm_data inline script block. The attacker then extracts the server_options fields to obtain the external MySQL host, database name, user, and plaintext password. The recovered credentials can then be used to connect directly to the external database if it is reachable from the internet or from a pivot point.

// Prose description only - no verified exploit code is published.
// The vulnerable data path writes woof_settings[woof_stat][server_options]
// into an inline <script> block as the woof_tm_data object on frontend pages.
// See the Wordfence advisory and the plugin source references for details.

Detection Methods for CVE-2026-107646

Indicators of Compromise

Presence of a woof_tm_data inline script block containing a populated server_options object on public frontend pages
Unexpected inbound connections to the external MySQL host from unknown source IPs following plugin exposure
Repeated unauthenticated GET requests from a single source enumerating product filter and category pages
Web server access logs showing automated crawlers requesting pages that render the HUSKY filter widget

Detection Strategies

Fetch public pages that render the HUSKY filter and grep the response body for woof_tm_data and server_options to confirm exposure
Inventory WordPress sites using the HUSKY – Products Filter for WooCommerce Professional plugin at version 1.4.5 or earlier
Review the plugin's Statistics extension configuration to determine whether external MySQL credentials are stored and whether Turbo Mode is active
Correlate external MySQL authentication logs with WordPress frontend access logs to identify credential reuse

Monitoring Recommendations

Monitor the external MySQL server for logins from IPs outside the application tier allowlist
Alert on new or anomalous outbound HTTP requests scraping frontend filter pages
Track WordPress plugin version drift and flag HUSKY installations that remain on vulnerable builds
Enable query auditing on the Statistics database to detect reconnaissance SQL from recovered credentials

How to Mitigate CVE-2026-107646

Immediate Actions Required

Disable the Statistics extension and Turbo Mode in the HUSKY – Products Filter plugin until a fixed version is installed
Rotate the external MySQL password and any credentials that share values with the exposed account
Restrict the external MySQL host to allowlisted application IPs and block public network exposure
Review web server logs for prior scraping of pages that render the filter and treat exposed credentials as compromised

Patch Information

At publication, the NVD entry lists all versions up to and including 1.4.5 as vulnerable. Administrators should consult the Wordfence Vulnerability Analysis and the WordPress.org plugin page for the current fixed release and update immediately once available. Source references for the vulnerable code paths are published in the WooCommerce Filter Turbo Mode Script and WooCommerce Filter Tabs Content Script.

Workarounds

Clear the server_options fields in woof_settings[woof_stat] so no credentials are stored in plugin configuration
Disable Turbo Mode to prevent emission of the woof_tm_data inline script object
Deactivate the HUSKY – Products Filter Professional plugin on affected sites until patched
Place the WordPress site behind a web application firewall rule that strips woof_tm_data from outbound responses as a temporary compensating control

bash

# Configuration example: verify exposure from an unauthenticated client
curl -s https://example.com/shop/ | grep -o 'woof_tm_data[^<]*server_options[^<]*'