CVE-2024-7491

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3156511%40woocommerce-products-filter&old=3129454%40woocommerce-products-filter&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/daf6b0d5-79a6-4b8f-924e-9e78cb2b5742?source=cveThird Party Advisory

Published

Sep 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7485The Traffic Manager plugin for WordPress is vulnerable to St…7.2
• CVE-2024-7486The MultiPurpose theme for WordPress is vulnerable to PHP Ob…8.8
• CVE-2024-7487An improper authentication vulnerability exists in WSO2 Iden…5.8
• CVE-2024-7488Integer Overflow or Wraparound, Improper Validation of Speci…5.3
• CVE-2024-7489The Forms for Mailchimp by Optin Cat – Grow Your MailChimp L…4.4
• CVE-2024-7490Improper Input Validation vulnerability in Microchip Techolo…9.8
• CVE-2024-7492The MainWP Child Reports plugin for WordPress is vulnerable …8.8
• CVE-2024-7493The WPCOM Member plugin for WordPress is vulnerable to privi…9.8
• CVE-2024-7494A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-7495A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-7496A vulnerability has been found in itsourcecode Airline Reser…8.8
• CVE-2024-7497A vulnerability was found in itsourcecode Airline Reservatio…8.8