HUSKY – Products Filter for WooCommerce Professional, a WordPress plugin, allows unauthenticated attackers to read the MySQL host, database name, username, and plaintext password stored in the woof_settings[woof_stat][server_options] array. Exposed credentials are embedded in the woof_tm_data script object on any public front‑end filter page, enabling disclosure of configuration that could lead to database compromise. The weakness is a confidentiality breach due to lack of proper access control over sensitive configuration data.

All installations of HUSKY – Products Filter for WooCommerce Professional versions 1.4.5 and below are affected. The vulnerability is only exploitable when the plugin’s Statistics extension is enabled, the admin has saved external MySQL connection credentials, and Turbo Mode is also enabled. The plugin is distributed by realmag777 under the product name HUSKY – Products Filter for WooCommerce Professional.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker does not need any privileged privileges; simply accessing a public filter page that loads the woof_tm_data script will reveal the credentials. Because the disclosure is client‑side and the attack vector is unauthenticated, the risk is moderate but potentially high if the exposed credentials grant wide access to the database.