What is the CVSS score of CVE-2025-11735?

CVE-2025-11735 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of HUSKY Products Filter are affected by CVE-2025-11735?

The HUSKY - Products Filter Professional for WooCommerce WordPress plugin, in versions up to and including 1.3.7.1, contains an unauthenticated blind SQL injection that can allow a remote attacker to…

How to fix or mitigate CVE-2025-11735?

No vendor-released patch identified at time of analysis. Within 24 hours, inventory all WordPress installations for the HUSKY - Products Filter Professional for WooCommerce plugin and identify any instance running versions up to and including 1.3.7.1; if the plugin is not essential, deactivate and remove it immediately, and if it must remain active, block or restrict access to the by_text_2 text-phrase filter and the phrase parameter using WAF rules or virtual patching and enable database query logging and alerting. Within 7 days, confirm whether a vendor-released patch has been issued beyond 1.3.7.1, apply it as soon as available, and for unpatched instances implement compensating controls such as disabling the text-search phrase functionality, restricting plugin and WooCommerce search endpoints to trusted networks, and rotating database credentials and WordPress salts if compromise is suspected. Within 30 days, validate that every instance is either updated to a vendor-fixed version or removed, review database and web logs for blind SQL injection indicators, and update WordPress plugin governance to prevent similar unauthenticated data-exposure risks.

HUSKY Products Filter CVE-2025-11735

HIGH

SQL Injection (CWE-89)

2025-10-28 security@wordfence.com

WordPress SQLi Woocommerce Wordpress Plugin

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote request to a public parameter (AV:N/AC:L/PR:N/UI:N); blind SQLi enables database read (C:H) with no stated write or DoS (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 11:44 vuln.today

CVE Published

Oct 28, 2025 - 06:15 cve.org

HIGH 7.5

DescriptionCVE.org

The HUSKY - Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the phrase parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated blind SQL injection in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin (all versions up to and including 1.3.7.1) allows a remote attacker to append arbitrary SQL to the text-search query via the phrase parameter and read sensitive data from the site's database through blind extraction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms no authentication, no privileges and no user interaction are required, and impact is confined to confidentiality with no integrity or availability effect. Real-world risk is constrained by a product-specific precondition (the plugin, and its by_text_2 text-phrase filter, must be installed, active and reachable) and by weak exploitation signals: EPSS is only 0.35% (26th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the HUSKY - Products Filter Professional for WooCommerce plugin, an e-commerce filtering extension that exposes a text-search module referenced in the advisory as by_text_2 (see the WordPress plugin Trac source at ext/by_text_2/index.php, around line 164). Root cause is CWE-89 (SQL Injection): the user-supplied phrase parameter is interpolated into an existing SQL query with insufficient escaping and no adequate use of prepared statements, so attacker-controlled input becomes part of the query structure rather than a bound value. Because the filter is intended to run on public-facing WooCommerce catalog pages, the query path is reachable without authentication, which is reflected in the PR:N/UI:N components of the CVSS vector. The injection is blind, meaning results are not reflected directly; an attacker must infer data through boolean- or time-based conditional responses, which slows extraction but does not prevent it. The scope of impact stays within confidentiality (C:H, I:N, A:N) because the injected statements are used to read, not modify or destroy, database content. The plugin runs on the WordPress/WooCommerce stack (PHP, MySQL/MariaDB), so extracted data may include WooCommerce customer records, order metadata and WordPress user tables, depending on the database user's privileges.

Affected ProductsAI

The HUSKY - Products Filter Professional for WooCommerce plugin for WordPress is affected in all versions up to and including 1.3.7.1, as stated in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ebaec880-0d1c-4725-a746-530f48821279?source=cve). The exposed code path is the plugin's text-phrase search extension, documented in the plugin repository at https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_text_2/index.php#L164. No CPE strings were supplied with the source data, so affected installations must be identified by plugin slug/name and version (woocommerce-products-filter <= 1.3.7.1) across WordPress sites that have WooCommerce and the plugin's text filter active. Any version later than 1.3.7.1 is outside the stated affected range.

RemediationAI

No fixed version is identified in the available data, so the primary action is to update the HUSKY - Products Filter Professional for WooCommerce plugin to the newest release published by the vendor and confirm the installed version is greater than 1.3.7.1; the affected source line is visible at https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_text_2/index.php#L164 and the authoritative vulnerability record is the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ebaec880-0d1c-4725-a746-530f48821279?source=cve, which should be re-checked for an exact patched version before relying on the upgrade alone. If an immediate upgrade is not possible, disable or remove the plugin's text-search/by_text_2 filter so the phrase parameter never reaches the unsanitized query, accepting the functional trade-off that storefront keyword filtering stops working; alternatively, restrict access to the endpoints that accept phrase (for example blocking or challenging requests carrying that parameter at the WAF or reverse-proxy layer), which may break legitimate searches and can be bypassed by encoding variations. Because the flaw is unauthenticated and blind, detection is difficult post-hoc; review database and web logs for anomalous SQL-like patterns in the phrase parameter, and note that patching does not undo any data already extracted, so a credential and customer-data exposure review is warranted on sites that ran an affected version.