CVE-2025-13109: 
WordPress vulnerability analysis and mitigation

CVE-2025-13109 is an Insecure Direct Object Reference (IDOR) vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. It affects all versions up to and including 1.3.7.2, allowing authenticated attackers with subscriber-level access or above to manipulate saved search queries in any user's profile, including administrators. The vulnerability was published on December 3, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639), where the woof_add_query and woof_remove_query functions fail to validate a user-supplied key before performing operations on user profile data. Because no ownership or authorization check is enforced on the target user identifier, any authenticated user can supply an arbitrary user ID to insert or remove saved search queries from profiles belonging to other users, including administrators. The attack vector is network-based, requires low privileges (subscriber account), no user interaction, and low attack complexity (Wordfence, WordPress Changeset).

Successful exploitation allows an authenticated attacker to insert or remove arbitrary saved search queries from any WordPress user's profile, including site administrators. While there is no direct confidentiality or availability impact, the integrity of user profile data can be compromised, potentially disrupting administrator workflows or injecting unexpected query configurations. The scope is limited to the affected WordPress installation, and lateral movement or remote code execution are not directly achievable through this vulnerability alone (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-13109. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a subscriber-level account on the target WordPress site, limiting opportunistic mass exploitation (Wordfence, Red Hat CVE).

1. Obtain a low-privilege account: Register or obtain a subscriber-level (or higher) account on the target WordPress site running HUSKY – Products Filter Professional for WooCommerce version ≤ 1.3.7.2.
2. Identify target user IDs: Enumerate WordPress user IDs for high-value targets (e.g., administrators) using publicly accessible endpoints such as the WordPress REST API (/wp-json/wp/v2/users) or author archive pages.
3. Craft a malicious request: Send an authenticated HTTP request to the endpoint invoking woof_add_query or woof_remove_query, supplying the target administrator's user ID as the user-controlled key parameter instead of the attacker's own user ID.
4. Manipulate profile data: The plugin performs the add or remove operation on the target user's saved search queries without validating ownership, resulting in unauthorized modification of the administrator's profile data (Wordfence, WordPress Changeset).

• Logs: WordPress access logs showing authenticated POST requests to AJAX endpoints (e.g., wp-admin/admin-ajax.php) invoking woof_add_query or woof_remove_query actions with user ID parameters that do not match the authenticated session's user ID.
• Database: Unexpected or unfamiliar saved search query entries in the wp_usermeta table associated with administrator accounts, particularly if inserted by a lower-privileged user.
• Logs: Repeated requests from the same low-privilege user account targeting multiple different user IDs in a short time window, suggesting enumeration or bulk manipulation.

Users should update the HUSKY – Products Filter Professional for WooCommerce plugin to version 1.3.7.3 or later, which addresses the missing authorization validation in the affected functions. The fix was introduced in WordPress plugin changeset 3400527 (WordPress Changeset). As a temporary workaround, site administrators can restrict new user registrations or limit subscriber-level access until the patch is applied. Regularly auditing user roles and plugin versions is recommended as a general security practice.

Sucuri noted CVE-2025-13109 in their December 2025 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). No significant independent researcher commentary or notable social media discussion has been identified for this vulnerability beyond standard aggregator coverage.