CVE-2025-13109

MEDIUM

HUSKY - Products Filter Professional <1.3.7.2 - Info Disclosure

Title source: llm

Description

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset/3400527

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/9effc186-c225-4b3b-9b8c-c453505a41de?source=cve

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 8.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (1)

realmag777/HUSKY – Products Filter Professional for WooCommerce < 1.3.7.2

Published Dec 03, 2025

Tracked Since Feb 18, 2026