The HUSKY – Products Filter Professional for WooCommerce plugin suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, the 'name' parameter in the woof shortcode is not properly escaped or prepared, enabling authenticated attackers with contributor-level privileges or above to append arbitrary SQL queries. This vulnerability affects all versions up to 1.3.5.2 and can be exploited to extract sensitive data from the database. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated user with contributor or higher privileges to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, modification of data, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site’s database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Monitor for updates from the vendor realmag777 regarding patches or official fixes for this vulnerability.