CVE-2024-6457 is a critical SQL Injection vulnerability in the HUSKY – Products Filter Professional for WooCommerce WordPress plugin. The flaw exists due to improper neutralization of special elements in the 'woof_author' parameter, allowing unauthenticated attackers to append malicious SQL queries. This vulnerability enables time-based SQL Injection attacks that can extract sensitive data from the backend database. It affects all plugin versions up to 1.3.6. No vendor patch or remediation information is provided in the available data.

Successful exploitation of this vulnerability can lead to full compromise of the backend database confidentiality, integrity, and availability. Attackers can extract sensitive information without authentication, potentially leading to data breaches and further system compromise. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to the affected functionality to trusted users only. Monitoring for unusual database activity may help detect exploitation attempts. Avoid using the vulnerable versions of the plugin in production environments.