CVE-2025-13109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13109", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-12T23:36:07.758Z", "datePublished": "2025-12-03T12:29:56.230Z", "dateUpdated": "2026-04-08T17:11:53.390Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:53.390Z"}, "affected": [{"vendor": "realmag777", "product": "HUSKY \u2013 Products Filter Professional for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HUSKY \u2013 Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the \"woof_add_query\" and \"woof_remove_query\" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators."}], "title": "HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9effc186-c225-4b3b-9b8c-c453505a41de?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3400527"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-03T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-13T00:18:15.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-03T00:25:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T13:56:11.523862Z", "id": "CVE-2025-13109", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T13:56:18.714Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T13:56:11.523862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T13:56:15.454Z"}}], "cna": {"title": "HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "realmag777", "product": "HUSKY \u2013 Products Filter Professional for WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.7.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-13T00:18:15.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-03T00:25:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9effc186-c225-4b3b-9b8c-c453505a41de?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3400527"}], "descriptions": [{"lang": "en", "value": "The HUSKY \u2013 Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the \"woof_add_query\" and \"woof_remove_query\" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-03T12:29:56.230Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13109", "state": "PUBLISHED", "dateUpdated": "2025-12-03T13:56:18.714Z", "dateReserved": "2025-11-12T23:36:07.758Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-03T12:29:56.230Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HUSKY \u2013 Products Filter Professional for WooCommerce", "vendor": "realmag777", "versions": [{"lessThanOrEqual": "1.3.7.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HUSKY \u2013 Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the \"woof_add_query\" and \"woof_remove_query\" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators."}, {"lang": "es", "value": "El plugin HUSKY - Products Filter Professional para WooCommerce para WordPress es vulnerable a una Referencia Directa Insegura a Objeto (IDOR) en todas las versiones hasta la 1.3.7.2, inclusive, a trav\u00e9s de las funciones \u201cwoof_add_query\u201d y \u201cwoof_remove_query\u201d debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto permite a atacantes autenticados, con acceso de nivel suscriptor o superior, insertar o eliminar consultas de b\u00fasqueda guardadas arbitrarias en el perfil de cualquier usuario, incluidos los administradores."}], "id": "CVE-2025-13109", "lastModified": "2026-10-18T17:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13109", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T13:56:11.523862Z", "version": "2.0.3"}}]}, "published": "2025-12-03T13:16:01.807", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3400527"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9effc186-c225-4b3b-9b8c-c453505a41de?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:49:47.089861+00:00", "value": {"mitigation_remediation": ["Update the HUSKY \u2013 Products Filter Professional for WooCommerce plugin to the latest released version (at least 1.3.7.3) following the patch committed in the referenced changeset.", "If an immediate update cannot be performed, temporarily disable the HUSKY plugin or remove the woof_add_query and woof_remove_query functions until a fix is available.", "Review the roles of all subscriber accounts on the site, restrict unnecessary subscriber privileges, and consider enforcing two\u2011factor authentication for elevated roles."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized modification of user saved search queries, potentially enabling compromised administrators"}, "threat_synthesis": {"affected_systems": "The affected software is the HUSKY \u2013 Products Filter Professional for WooCommerce plugin for WordPress, released by realmag777. Versions up to and including 1.3.7.2 are vulnerable.", "description_and_impact": "An Insecure Direct Object Reference vulnerability in the HUSKY \u2013 Products Filter Professional for WooCommerce plugin allows an authenticated user with subscriber permissions to add or delete arbitrary saved search queries for any user, including administrators. This flaw arises from missing validation on user\u2010controlled keys within the woof_add_query and woof_remove_query functions, permitting attackers to alter other users\u2019 saved search configurations and potentially expose or manipulate data that is queried on the front end.", "risk_and_exploitability": "The CVSS score is 4.3 and the EPSS score is below 1%, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be within the WordPress administration interface or plugin API calls, requiring authenticated access with a subscriber role or higher. While the likelihood of exploitation is low, the vulnerability allows an attacker to modify another user\u2019s saved queries, which could lead to unintended data exposure or site presentation changes. Mitigating the risk involves limiting subscriber privileges or disabling the plugin until a patch is applied."}}}}, "created": "2025-12-04T16:44:20.162203+00:00", "updated": "2026-04-21T18:00:11.714865+00:00", "vendors": ["realmag777", "realmag777$PRODUCT$huskys_products_filter_professional_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}