CVE-2025-13110: 
WordPress vulnerability analysis and mitigation

CVE-2025-13110 is an Insecure Direct Object Reference (IDOR) vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. It affects all versions up to and including 1.3.7.3, and was disclosed on December 18, 2025. The flaw allows authenticated attackers with subscriber-level access or above to create product messenger subscriptions on behalf of arbitrary users, including administrators. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It exists in the woof_add_subscr function, which fails to validate a user-controlled key before processing subscription creation requests. Because no server-side ownership check is performed, any authenticated user can supply an arbitrary target user identifier (including an administrator's) and successfully register a product messenger subscription on their behalf. The attack vector is network-based, requires low privileges, and no user interaction (Wordfence, ENISA EUVD).

Successful exploitation allows a low-privileged authenticated attacker to manipulate product messenger subscriptions for any WordPress user account, including site administrators. While direct confidentiality and availability impacts are rated as none, the integrity impact enables unauthorized subscription creation that could be leveraged for account-level manipulation or social engineering against administrators. In a worst-case scenario, this could facilitate account takeover or unauthorized administrative actions if subscription mechanisms are tied to authentication or notification workflows (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-13110. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a subscriber-level account on the target WordPress site (Wordfence).

1. Reconnaissance: Identify WordPress sites running the HUSKY – Products Filter Professional for WooCommerce plugin at version 1.3.7.3 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain low-privilege access: Register or obtain a subscriber-level account on the target WordPress site (e.g., via open registration).
3. Identify target user: Enumerate WordPress user IDs for privileged accounts (e.g., administrators) through publicly exposed author pages (/?author=1) or REST API endpoints (/wp-json/wp/v2/users).
4. Craft malicious request: Send an authenticated HTTP request to the endpoint invoking the woof_add_subscr function, supplying the target administrator's user ID as the user-controlled key parameter instead of the attacker's own ID.
5. Create unauthorized subscription: The server, lacking proper ownership validation, processes the request and creates a product messenger subscription attributed to the target administrator account (Wordfence, ENISA EUVD).

• Logs: WordPress access logs showing authenticated POST requests to the woof_add_subscr endpoint with user ID parameters that do not match the authenticated session's user ID.
• Database: Unexpected entries in the product messenger subscriptions table where the subscriber user ID corresponds to administrator accounts but the originating session belongs to a low-privilege user.
• Network: Repeated requests from the same IP or session targeting the subscription function with varying user ID values, suggesting enumeration of user accounts.

The vulnerability is patched in HUSKY – Products Filter Professional for WooCommerce version 1.3.7.4 and later. Site administrators should update the plugin immediately via the WordPress admin dashboard or by applying the changesets available in the plugin's SVN repository. No configuration-based workaround is available; upgrading to the patched version is the only recommended remediation (Wordfence, WordPress SVN).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 18, 2025. Sucuri included it in their December 2025 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.