CVE-2024-7491 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, versions up to and including 1.3.6.1. This flaw, specifically within the woof_messenger_remove_subscr AJAX action, allows authenticated attackers with subscriber-level access to unsubscribe users from product notifications. The vulnerability stems from insufficient validation of a user-controlled 'key' value, which, if obtained or brute-forced, can be exploited. Rated as Medium severity (CVSS 4.3), the vulnerability has a network attack vector and low attack complexity, requiring no user interaction. The potential impact is limited to low integrity, as it only allows for the removal of notification subscriptions, with no confidentiality or availability impact. This vulnerability is only exploitable if the plugin's Products Messenger extension is enabled. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.3.6.2CPE matchmatch criteria | cpe:2.3:a:pluginus:husky_-_products_filter_professional_for_woocommerce:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.