CVE-2024-6457

The vulnerability present in the HUSKY – Products Filter Professional for WooCommerce plugin stems from a time-based SQL Injection flaw associated with the ‘woof_author’ parameter. This weakness arises from inadequate escaping of user-supplied input and insufficient preparation of the SQL query, which allows attackers to manipulate the SQL statements executed by the application. When an attacker sends specially crafted requests to the affected plugin, they can inject additional SQL commands into the existing queries. This manipulation can lead to unauthorized access to sensitive data stored in the database, including user information, product details, and potentially administrative credentials.

Exploitation of this vulnerability can occur through various attack vectors. An unauthenticated attacker can leverage the flaw by crafting requests that exploit the SQL injection vulnerability. For instance, an attacker could use a web application testing tool to automate the injection process, sending multiple requests to the server to determine the structure of the database and extract sensitive information. By timing the responses from the server, the attacker can infer the existence and content of data in the database, effectively bypassing authentication mechanisms and accessing restricted information. This type of attack is particularly insidious because it does not require any prior authentication, making it accessible to a wide range of malicious actors.

The real-world impact of this vulnerability can be significant for businesses utilizing the affected plugin. The ability to extract sensitive information can lead to data breaches, which may result in financial losses, reputational damage, and legal ramifications. For e-commerce platforms, the exposure of customer data, including payment information and personal details, can lead to identity theft and fraud. Furthermore, businesses may face regulatory scrutiny and potential penalties if they fail to protect user data adequately. The long-term consequences of a successful attack can include loss of customer trust, decreased sales, and increased costs associated with incident response and recovery efforts.

To detect and mitigate this vulnerability, organizations should implement several strategies. Regular security assessments, including penetration testing and code reviews, can help identify and remediate vulnerabilities in web applications. Employing web application firewalls (WAF) can provide an additional layer of security by filtering out malicious requests before they reach the application. Additionally, developers should adopt secure coding practices, such as using prepared statements and parameterized queries, to prevent SQL injection vulnerabilities from being introduced in the first place. Keeping the plugin and all associated components up to date is crucial, as updates often include patches for known vulnerabilities.

In conclusion, the SQL injection vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin represents a serious threat to the security of WordPress-based e-commerce sites. The potential for unauthorized data access poses significant risks to businesses, making it imperative for organizations to prioritize security measures. By understanding the technical details of the vulnerability, recognizing potential attack vectors, assessing the real-world impact, and implementing effective detection and mitigation strategies, businesses can better protect themselves against this and similar threats in the future.

CSURFACE threat intelligence has updated the severity rating of CVE-2024-6457, elevating its CVSS score from 7.5 to 9.8. This adjustment reflects a refined understanding of the vulnerability’s impact, particularly emphasizing its critical potential for unauthenticated attackers to perform time-based SQL injection attacks that can exfiltrate sensitive data from WordPress e-commerce databases. Although our telemetry does not indicate a surge in active exploitation or the emergence of new proof-of-concept exploits, the heightened severity underscores the urgency for defenders to reassess their risk posture. The stable EPSS score suggests that while exploitation attempts remain steady, the critical nature of this vulnerability increases the likelihood of targeted attacks, especially given the widespread use of the affected plugin. Consequently, organizations relying on the HUSKY – Products Filter Professional for WooCommerce plugin should consider this vulnerability a top-tier threat, as the elevated CVSS score signals a greater potential for impactful breaches if left unaddressed.

Update 2 — May 21, 2026

The recent downward revision of the CVSS score for CVE-2024-6457 from 9.8 to 7.5 reflects a refined understanding of the vulnerability’s exploitability and impact. CSURFACE threat intelligence attributes this adjustment to improved contextual analysis of the attack vector and the conditions required for successful exploitation, indicating that while the vulnerability remains serious, it is less likely to be trivially exploited at scale. Our telemetry confirms the EPSS score has stabilized without a notable increase in exploitation attempts, suggesting threat actors have not accelerated offensive operations targeting this flaw. This recalibration is significant for defenders as it nuances the prioritization of patching and monitoring efforts; the vulnerability still demands attention due to its potential for sensitive data extraction via unauthenticated SQL injection, but it may not represent an immediate critical emergency. The overall threat level remains high, yet the reduced severity score signals a more measured risk environment, allowing security teams to balance resource allocation more effectively amid competing priorities.