CVE-2026-107646 realmag777 CVE debrief

Who should care

WordPress site administrators and security teams who use the HUSKY – Products Filter for WooCommerce Professional plugin, especially those who have enabled the Statistics extension and Turbo Mode, should assess their exposure and verify configurations to prevent potential unauthorized access to MySQL connection credentials.

Why it matters

CVE-2026-107646 exposes sensitive MySQL credentials in HUSKY – Products Filter for WooCommerce Professional plugin. WordPress administrators and security teams must assess exposure, verify configurations, and prioritize remediation to prevent potential database compromise or data exposure.

• Potential unauthorized access to MySQL connection credentials
• Increased risk of database compromise or data exposure
• Need for verification of plugin configurations and Statistics extension usage
• Prioritization of remediation for sites with Turbo Mode enabled

Technical summary

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5. The vulnerability is caused by the exposure of external MySQL host, database name, username, and plaintext password stored in 'woof_settings[woof_stat][server_options]' parameter. This information is accessible through the inline 'woof_tm_data' script object on any public frontend filter page when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode.

Defensive priority

Assess exposure and verify configurations for HUSKY – Products Filter for WooCommerce Professional plugin on WordPress sites, especially those with Statistics extension and Turbo Mode enabled.

Recommended defensive actions

• Inventory and verify configurations for HUSKY – Products Filter for WooCommerce Professional plugin on WordPress sites
• Assess exposure and prioritize remediation for sites with Statistics extension and Turbo Mode enabled
• Monitor for potential unauthorized access to MySQL connection credentials
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in versions up to and including 1.4.5 of the HUSKY – Products Filter for WooCommerce Professional plugin. It requires the Statistics extension to be enabled, external MySQL connection credentials to be saved, and Turbo Mode to be enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.