CVE-2025-13110 is an authorization bypass vulnerability in the HUSKY – Products Filter Professional for WooCommerce WordPress plugin, affecting all versions up to 1.3.7.3. The issue is due to an insecure direct object reference caused by missing validation on a user-controlled key parameter in the "woof_add_subscr" function. This flaw allows authenticated users with subscriber-level privileges or higher to create product messenger subscriptions impersonating other users, including administrators. The vulnerability has a CVSS 3.1 score of 4.3 (medium severity), with no known exploits reported. The plugin is not a cloud service, and no patch or official remediation has been documented yet.

An authenticated attacker with subscriber-level access or higher can exploit this vulnerability to create product messenger subscriptions on behalf of arbitrary users, including administrators. This could lead to unauthorized actions performed in the context of other users but does not directly impact confidentiality or availability. The impact is limited to integrity due to unauthorized subscription creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for unusual subscription creation activity. Avoid granting unnecessary privileges to users. Follow updates from the vendor realmag777 for any forthcoming patches or official mitigations.