Introduction
Unauthenticated attackers can extract sensitive WooCommerce customer data from stores running an outdated version of the HUSKY Products Filter Professional for WooCommerce plugin. The vulnerability, tracked as CVE-2025-11735, allows blind SQL injection through the product search interface. Affected WordPress e-commerce sites are at risk of data exposure and manipulation.
HUSKY Products Filter Professional for WooCommerce is a widely used WordPress plugin with over 100,000 active installations. It adds advanced product filtering to WooCommerce stores, and many online retailers rely on it for customizable search and filter options.
Technical Information
CVE-2025-11735 is a blind SQL injection vulnerability in all versions of the HUSKY Products Filter Professional for WooCommerce plugin up to and including 1.3.7.1. The plugin's text filtering functionality does not sufficiently escape the phrase parameter, and it does not properly prepare the SQL query that uses it. As a result, unauthenticated attackers can inject additional SQL statements into backend queries and may be able to extract sensitive information from the WordPress database.
The vulnerable code is in /ext/by_text_2/index.php at line 164 (reference).
The plugin builds SQL queries directly from user-supplied input in the phrase parameter, without sufficient sanitization and without parameterized queries. That leaves it open to both boolean-based and time-based blind SQL injection. The application does not return query results directly, but attackers can infer database content from differences in its behavior or response times.
No authentication is required, so any site visitor can exploit the flaw without logging in. That sharply raises the risk for affected WooCommerce installations.
Patch Information
The plugin's developers have addressed this vulnerability in version 1.3.7.1 and made further security improvements in 1.3.7.2. To remediate CVE-2025-11735, update to at least version 1.3.7.1. The changelog and update details are on the WordPress.org plugin page.
Affected Systems and Versions
- Product: HUSKY Products Filter Professional for WooCommerce (formerly WOOF)
- Affected versions: All versions up to and including 1.3.7.1
- Vulnerable configuration: Any WordPress installation with the affected plugin version active
Vendor Security History
The HUSKY Products Filter Professional for WooCommerce plugin has a documented history of security issues. These include multiple SQL injection vulnerabilities (e.g., CVE-2024-6457, CVE-2023-40010) and other flaws such as XSS and access-control weaknesses. The vendor has released patches for reported issues, but similar vulnerabilities keep recurring. That suggests secure coding practices and systematic code reviews have not been applied consistently across the codebase.
