Security Alert Summary
The HUSKY 6 Products Filter Professional for WooCommerce plugin is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the woof_add_subscr function. Missing validation of a user-controlled key allows authenticated users with subscriber-level access or higher to create product messenger subscriptions on behalf of arbitrary users, including administrators.
CVE Details
- CVE ID:
CVE-2025-13110 - Affected plugin / component: HUSKY 6 Products Filter Professional for WooCommerce plugin for WordPress (as stated in the CVE description)
- Affected versions: All versions up to, and including, 1.3.7.3 (as stated in the CVE description)
- Published: December 18, 2025 at 1:15:46 PM
- Last modified: December 18, 2025 at 3:07:18 PM
- CVSS v3.1: Base Score 4.3 (MEDIUM) — Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User Interaction: Privileges Required: Low (an authenticated user with subscriber-level access or higher); User Interaction: None.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None.
- Weakness (CWE):
CWE-639
Technical Details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the plugin’s woof_add_subscr function. According to the CVE description, the function fails to validate a user-controlled key, which permits an authenticated attacker with subscriber-level privileges or above to create product messenger subscriptions on behalf of arbitrary users, including administrators. The root cause is missing validation checks on input that controls which user account a subscription is associated with.
Because the issue is an IDOR tied to a specific function and missing validation, exploitation does not require user interaction and can be performed by any authenticated user with the required low privileges. The stated impact is limited to integrity (creation of subscriptions under other users) and does not indicate direct confidentiality or availability loss in the CVE entry.
How This Could Impact Your Website
In a realistic scenario, an external contributor or contractor with a subscriber-level account could create subscriptions that appear to belong to other site users, including administrators. This may result in unwanted automated messages, incorrect notification routing, or the appearance of actions taken by other accounts. For site owners and internal staff, such behavior can increase the risk of social engineering or targeted phishing if attacker-controlled subscriptions are used to interact with or gather information about other users.
Potential practical consequences include inadvertent notifications being sent in the name of another user, disruption to normal communication flows, and an elevated risk of targeted phishing or social engineering against staff members. If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Check for and apply updates to the affected plugin as soon as a patched version is available. (The CVE entry does not specify a patched or fixed version.)
- Review and reduce unnecessary user roles and permissions—remove or limit subscriber-level accounts that are not required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your WordPress installation.
- Monitor site activity and logs for unusual behavior, such as unexpected subscription creations or changes associated with administrator accounts.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
