CVE Alert: CVE-2025-11735 – realmag777 – HUSKY – Products Filter Professional for WooCommerce

Risk verdict

High severity: unauthenticated remote SQL injection could expose sensitive data; current exploitation indicators are not confirmed in the wild.

Why this matters

The vulnerability affects all versions up to 1.3.7.1 of a WooCommerce filter plugin, enabling attackers to append SQL to a user-supplied phrase parameter without authentication. That could lead to data disclosure from the database, including potentially customer and product information, with all the business and regulatory implications.

Most likely attack path

Network-accessible REST/endpoint call to the vulnerable phrase parameter, no authentication required, and no user interaction needed. The attacker can read data via injected queries, but integrity and availability are not directly impacted. The attack relies on insufficient input sanitisation and lack of prepared statements; successful exploitation hinges on the web application allowing unpatched SQL execution paths.

Who is most exposed

WordPress sites with the HUSKY – Products Filter Professional for WooCommerce plugin installed, especially in shared hosting or environments with minimal patch cadence and exposed database access.

Detection ideas

• Unusual query strings in requests to the phrase parameter showing SQL-like syntax (UNION, information_schema, etc.).
• Database error messages or anomalous responses linked to filtered endpoints.
• WAF/IPS alerts on SQL injection patterns targeting this plugin.
• Sudden spikes in data transfer from the database or unexpected data returned in plugin-related endpoints.

Mitigation and prioritisation

• Patch to a version beyond 1.3.7.1 as soon as available; validate compatibility with WooCommerce.
• If patching is delayed, disable or remove the plugin; apply compensating controls (WAF rules, stricter input validation).
• Implement monitoring for anomalous data exfiltration and database access.
• Conduct a data inventory and review access logs; ensure regular backups.
• If KEV is present or EPSS ≥ 0.5, treat as priority 1; otherwise, target a high-priority patch window (priority 2) with testing.