CVE-2023-40010CWE-89

WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injection

Critical · published December 20, 2023

CVSS v3.1
9.3
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

🔥 An SQL Injection vulnerability lurking in the HUSKY – Products Filter for WooCommerce Professional could give attackers the keys to your data kingdom with just a single crafted input! Think of it like a restaurant that takes orders without checking the menu — if you can convince the waiter to deliver a secret recipe, they might serve up something you never intended! An attacker could unleash absolute chaos by accessing or manipulating your database, potentially gaining sensitive customer data, changing product details, or even deleting critical information. This is a recipe for disaster, especially for e-commerce businesses relying on trust and integrity!

Put simply

Think of it like a restaurant that takes orders without checking the menu — if you can convince the waiter to deliver a secret recipe, they might serve up something you never intended! This SQL injection flaw arises from the improper handling of special characters in SQL commands, allowing attackers to insert malicious code and execute unauthorized queries against the database.

What to do

An attacker could unleash absolute chaos by accessing or manipulating your database, potentially gaining sensitive customer data, changing product details, or even deleting critical information. This is a recipe for disaster, especially for e-commerce businesses relying on trust and integrity! To protect yourself, immediately update the HUSKY – Products Filter for WooCommerce Professional to the latest version. Implement input validation and prepared statements to secure all database interactions. Don't delay — this vulnerability demands quick attention! You've got this! 🦸 Follow these steps, and you'll be well on your way to fortifying your e-commerce fortress!

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00588 · 47.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-12-20T15:06Z
EPSS history
Timeline
  • 20 DEC 15:06Z
    WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injection
    cvelistv5