Software component issue could expose accounts or credentials
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettings[woofstat][serveroptions]'…
What happened
- The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.Security Advisory CVE-2026-107646
- The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettings[woofstat][serveroptions]' parameter.Advisory description (CVE-2026-107646)
Contributing factors stated by the source
- The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettings[woofstat][serveroptions]' parameter.
The failure pattern
Watch the pattern: Weak or phishable authentication on a privileged path
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)
CISA reported that a self-replicating worm known as "Shai-Hulud" had compromised more than 500 npm packages.
Stolen OAuth tokens from the Salesloft Drift integration are used to export data from customers' Salesforce instances (2025)
From as early as August 8 to at least August 18, 2025, an actor tracked as UNC6395 used compromised OAuth tokens of the Salesloft Drift third-party application to access customers' Salesforce instances.
Malicious code committed to the Amazon Q Developer VS Code extension via a compromised token (AWS, 2025)
Malicious code was committed to the extension's open-source repository using a compromised GitHub token in a build configuration.
Call and text records of nearly all AT&T wireless customers taken from a third-party cloud workspace (2024)
Contractor credentials without MFA accessed third-party cloud data warehouse; downloaded 109 million customer call and text records.
Stolen credentials on a remote-access portal lead to the Change Healthcare ransomware outage (2024)
Single-factor remote access portal breached with stolen credentials; ransomware forced nationwide claims gateway disconnection.
Password spray on a legacy test tenant exposes Microsoft corporate email to a nation-state actor (2024)
Legacy test tenant without MFA compromised via password spraying; adversary created malicious OAuth apps with mail.read privileges.