CVE-2026-107646 HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
Unauthenticated attackers can extract plaintext MySQL credentials from public pages if specific plugin features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107646?
CVE-2026-107646 is a medium-severity vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
Weakness: CWE-200
Which versions are affected by CVE-2026-107646?
How do I fix CVE-2026-107646?
No fix has been published for CVE-2026-107646 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107646 being exploited?
There is no known exploitation of CVE-2026-107646 in the wild and no public exploit code.
Sources
Also known as GHSA-w4qc-rmgq-cc5g.