An Insecure Direct Object Reference vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin allows an authenticated user with subscriber permissions to add or delete arbitrary saved search queries for any user, including administrators. This flaw arises from missing validation on user‐controlled keys within the woof_add_query and woof_remove_query functions, permitting attackers to alter other users’ saved search configurations and potentially expose or manipulate data that is queried on the front end.

The affected software is the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, released by realmag777. Versions up to and including 1.3.7.2 are vulnerable.

The CVSS score is 4.3 and the EPSS score is below 1%, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be within the WordPress administration interface or plugin API calls, requiring authenticated access with a subscriber role or higher. While the likelihood of exploitation is low, the vulnerability allows an attacker to modify another user’s saved queries, which could lead to unintended data exposure or site presentation changes. Mitigating the risk involves limiting subscriber privileges or disabling the plugin until a patch is applied.