CVE-2022-4489 WOOF - Products Filter for WooCommerce < 1.3.2 - Admin+ PHP Object Injection
Admins can trigger PHP object injection via unserialized settings, potentially leading to code execution if suitable gadgets exist.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4489?
CVE-2022-4489 is a high-severity unsafe deserialization vulnerability in Unknown HUSKY, published on 6 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Which versions are affected by CVE-2022-4489?
It affects 1 product.
Products include Pluginus Husky - Products Filter Professional for Woocommerce.
How do I fix CVE-2022-4489?
No fix has been published for CVE-2022-4489 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-4489 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4489 exists.
Other vulnerabilities in Unknown HUSKY
- CVE-2025-1661 HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
- CVE-2024-6457 HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection
- CVE-2023-40010 WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injection
- CVE-2024-43121 WordPress HUSKY plugin <= 1.3.6.1 - Privilege Escalation vulnerability
- CVE-2024-32680 WordPress HUSKY plugin <= 1.3.5.2 - Remote Code Execution (RCE) vulnerability
Sources
Also known as GHSA-jhhr-q29j-x5hq.