HUSKY Products Filter EUVD-2026-102783

Exploitation requires three specific, non-default administrator configurations to all be active: the Statistics extension must be enabled, external MySQL connection credentials must have been saved, and Turbo Mode must be turned on. Only under this combination does the plugin emit woof_settings[woof_stat][server_options] into the inline woof_tm_data script object on public filter pages. Limiting factors: no attacker authentication or user interaction is needed (PR:N/UI:N), but a site using the default configuration, WordPress's internal database, or without the Statistics/Turbo Mode features enabled is not exposed; impact is confined to sites that store external MySQL credentials in the plugin.

Signals mostly align toward a moderate, conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L/I:N/A:N, base 5.3) describes an unauthenticated, network-reachable, read-only information leak with no integrity or availability impact. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active or at-scale exploitation (no public exploit identified at time of analysis). The tension here is between the modest base CVSS (C:L) and the actual sensitivity of the leaked data: the description states that plaintext external MySQL host, database name, username, and password are exposed to anonymous visitors, which is a total loss of confidentiality of a high-value secret and would, in my independent view, justify C:H rather than C:L. That is offset by a strong limiting factor - exploitation is only possible when an administrator has enabled the Statistics extension, saved external MySQL credentials, and turned on Turbo Mode simultaneously, a specific non-default combination - so the exposed population is a subset of installs rather than all of them. Net assessment: not a mass-exploitation emergency, but for any site matching the vulnerable configuration it is a genuine priority because it hands an unauthenticated attacker working database credentials with no effort.

An unauthenticated attacker browses to any public WooCommerce frontend page that renders the HUSKY products filter on a site where Statistics, external MySQL credentials, and Turbo Mode are all enabled. They view the page source and read the inline woof_tm_data script object, which contains woof_settings[woof_stat][server_options] with the external MySQL host, database name, username, and plaintext password. No public exploit code was identified in the provided data, but extraction requires only viewing page source, so it is trivial to perform.