The HUSKY – Products Filter Professional for WooCommerce plugin is vulnerable to blind SQL Injection through the phrase parameter. The flaw stems from inadequate escaping and a lack of prepared statements, which allows an attacker to append malicious SQL fragments to the existing query. This can lead to the extraction of sensitive database content by unauthenticated users, compromising confidentiality and potentially allowing further exploitation.

The vulnerability affects the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, with all releases up to and including version 1.3.7.1. The plugin is distributed by realmag777.

The issue carries a CVSS score of 7.5, indicating a considerable threat. The EPSS score of < 1 % reflects a very low, but non‑zero, probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The expected attack vector is through unauthenticated HTTP requests to the plugin’s filtering endpoint, where an attacker can supply a crafted phrase parameter. Successful exploitation results in information disclosure via blind injection, requiring repeated requests to infer the data.