EUVD-2026-114304
GHSA-86h5-2h32-hp24
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running HUSKY <= 1.4.6
-
ExploitSend unauthenticated request to unprotected function
-
ExecutionBypass missing authorization check
-
ImpactRetrieve restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The site must be running the HUSKY - Products Filter for WooCommerce plugin (realmag777) at version 1.4.6 or earlier; per the CVSS vector exploitation is remote and unauthenticated (AV:N/PR:N/UI:N) with no special configuration stated. The available sources do not describe which specific endpoint, action, or feature lacks the authorization check, so the exact trigger is not described in the available sources. The principal limiting factor is simply that the vulnerable plugin version must be installed and network-reachable; impact is confined to confidentiality (data exposure), with no integrity or availability effect per the vector. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is a high loss of confidentiality - consistent with the CWE-862 (Missing Authorization) / broken access control classification, i.e. unauthorized reading of data rather than modification (I:N) or disruption (A:N). Exploitation status is 'no public exploit identified at time of analysis': the single reference is a Patchstack advisory, not working exploit code, and there is no CISA KEV listing. No EPSS score and no SSVC automatable/technical-impact values were provided, so the probabilistic and decision-framework signals cannot be weighed; the only priority signal present is the vuln.today 'this_week' decision label, which aligns with an unauthenticated, easily reachable confidentiality bug but falls short of act_now/emergency. Net assessment: a genuinely attractive issue because it is unauthenticated and network-based, but with impact bounded to information disclosure and no confirmed exploitation or exploit code, this is a prompt-patch item rather than a drop-everything emergency. Key missing data (EPSS, POC confirmation, exact vulnerable endpoint) should be resolved before final prioritization. |
| Exploit ScenarioDerived | A remote attacker, without any account or user interaction, sends a crafted request to a WordPress site running the HUSKY - Products Filter for WooCommerce plugin at version 1.4.6 or earlier and reaches functionality that fails to enforce an authorization check, returning data that should be restricted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, special timing, or victim interaction are needed. No public proof-of-concept or exploit code has been identified; only a Patchstack advisory reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Broken access control in the Husky Products Filter for WooCommerce plugin (realmag777) at version 1.4.6 and earlier allows remote, unauthenticated attackers to reach functionality that performs no authorization check, resulting in high-impact exposure of confidential data while integrity and availability remain unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows that no credentials or user interaction are required, and the CWE-862 classification confirms the root cause is a missing authorization check rather than a memory-safety or injection defect; the available sources do not identify the specific endpoint, action or feature that lacks the check. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vuln.today priority decision is 'this_week'; no EPSS score was supplied with the intelligence.
RemediationAI
No vendor-released patch or exact fixed version is identified in the available data; the sole reference is the Patchstack database entry (https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerability/wordpress-husky-plugin-1-4-6-broken-access-control-vulnerability), which should be monitored as the authoritative source for a corrected release of Husky Products Filter above 1.4.6. Until such a release is confirmed, sites running 1.4.6 or earlier must treat the plugin's unauthenticated request handlers as publicly exposed; because the evidence does not identify which endpoint, action or feature is missing the authorization check, a targeted virtual patch or precise blocking rule cannot be derived from this data. The concrete compensating controls are therefore coarse: deactivate or remove the plugin on any store where product filtering is not essential, accepting the loss of that storefront functionality, or front the site with an upstream WAF/proxy that restricts access to the plugin's filtering requests, accepting that legitimate visitor filtering may break and that the rule set cannot be scoped to the vulnerable handler from the information available. Restore or re-enable the plugin only after the vendor or Patchstack confirms a release newer than 1.4.6 that addresses the missing authorization check.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Husky Products Filter is a WordPress plugin from vendor realmag777 that adds filtering of WooCommerce products (the plugin slug referenced in the advisory is woocommerce-products-filter). The CPE entry cpe:2.3:a:realmag777:husky:*:*:*:*:*:*:*:* identifies the affected component without encoding a version bound, so the version ceiling comes from the advisory text (1.4.6 and earlier). The weakness class is CWE-862, Missing Authorization: a function or route that should require a capability or nonce check is reachable without one, so the application returns data to a caller who should not be entitled to it. Because the deployment model is a WordPress plugin, the exposure surface is whatever unauthenticated AJAX, REST or admin-ajax handlers the plugin registers on a public-facing storefront, but the supplied evidence does not state which handler is affected, and the trigger is not described in the available sources. Impact is confined to confidentiality per the assessed vector; there is no stated path to modification or denial of service.
Know when Husky gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable missing-authorization flaw (PR:N, AV:N, AC:L) exposing restricted data, so C:H with I:N/A:N and no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
Executive ViewAI
The Husky Products Filter plugin for WooCommerce (versions 1.4.6 and earlier) contains a broken access control vulnerability that allows unauthenticated attackers to access confidential data without any authorization checks. This puts sensitive business information at risk and could lead to data breaches, regulatory penalties, and reputational damage. Leadership should prioritize remediation because the vulnerability is easy to exploit remotely and affects a widely used e-commerce component.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the plugin; block unauthenticated access to the plugin's endpoints via WAF or server configuration; restrict access to confidential data through additional authentication layers; monitor for unusual data access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenti
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes
Exploit-DB