CVE-2026-107646

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

• CWE-200

• https://plugins.svn.wordpress.org/woocommerce-products-filter/trunk/ext/turbo_mode/index.php
• https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/stat/views/tabs_content.php#L292
• https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L177
• https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L187
• https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/turbo_mode/index.php#L93
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1186aca4-012b-4512-9ab3-166b9f84d725?source=cve

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107637pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an…4.3
• CVE-2026-107638pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an…6.8
• CVE-2026-107639ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 co…8.8
• CVE-2026-10764Information disclosure in BVMS 4.5 up to 12.3 including allo…8.7
• CVE-2026-107640Integrics Enswitch 3.13 through 4.4 contains an authenticati…9.1
• CVE-2026-107645The Blocksy Companion plugin for WordPress is vulnerable to …9.1
• CVE-2026-107648The WP Sessions Time Monitoring Full Automatic plugin for Wo…7.2
• CVE-2026-107649The Events Made Easy plugin for WordPress is vulnerable to S…5.4
• CVE-2026-107650The GeoDirectory – WP Business Directory Plugin and Classifi…6.4
• CVE-2026-107651A flaw was found in Eye of GNOME (eog). A heap-based buffer …5.5
• CVE-2026-107652The Database Addon for Contact Form 7 – CFDB7 plugin for Wor…5.3
• CVE-2026-107655A flaw was found in CUPS. When processing embedded job ticke…4