HUSKY Products Filter Professional for WooCommerce Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference has been identified in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, affecting all versions through 1.3.7.2. The issue arises in the 'woof_add_query' and 'woof_remove_query' functions, where user-controlled keys lack proper validation. This vulnerability enables authenticated attackers with subscriber-level access or higher to manipulate saved search queries in any user's profile, including those of administrators.

Impact

Exploitation of this vulnerability allows for unauthorized modification of saved search queries in user profiles, potentially disrupting user experience or administrative functions.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access or higher can use the 'woof_add_query' function to insert a saved search query into another user's profile, or the 'woof_remove_query' function to delete a query from a user's profile. This can be done by sending a request that includes the user ID and the query data, bypassing the missing validation on the user-controlled key.

Remediation

Users are advised to update the HUSKY – Products Filter Professional for WooCommerce plugin to version 1.3.7.3 or a newer patched version.