CVE-2023-40334 is a medium severity (CVSS 4.3) missing authorization flaw in the HUSKY products filter plugin for WooCommerce, up to and including version 1.3.4.2. A logged in user with low privileges can do something they should not. Patchstack lists 1.3.4.3 as the fix.
What's affected
The record names the WordPress plugin HUSKY (WooCommerce Products Filter), versions up to and including 1.3.4.2. It scores the flaw 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
The weakness is CWE-862 (missing authorization). The record needs a low privilege account but no user interaction, and the impact is a low effect on integrity. The NVD text is that it allows exploiting incorrectly configured access control security levels.
Patchstack vulnerability database entry lists 1.3.4.3 as the patched version and rates its own priority as low. Patchstack's entry is dated 23 November 2023.
How to check if you're exposed
If you have shell access to the site, WP-CLI will show the installed version and whether an update is waiting:
wp plugin list --fields=name,status,version,update
wp plugin get woocommerce-products-filter --fields=name,version,update_version
Without WP-CLI, open Plugins in the WordPress admin and read the version under the plugin name. Anything at or below 1.3.4.2 is affected. Multisite owners should check each site and the network, because a plugin can be active on only some of them.
If you run many sites, collect the plugin list from each one and look for this plugin by its folder name, woocommerce-products-filter. You can also paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see which known CVEs touch your packages.
What to do now
- Find every site that has HUSKY (WooCommerce Products Filter) installed, active or not. A deactivated plugin still sits on disk.
- Update to 1.3.4.3 or later from the Plugins screen, or with
wp plugin update woocommerce-products-filter. - If the plugin is no longer used, delete it rather than leaving it deactivated.
- Check which user roles can sign in to the site, and remove accounts that no longer need access.
- Turn on automatic updates for plugins you rely on, and keep a short list of what is installed on each site.
Why it matters
The attacker in this case needs an account on the shop, which on many WooCommerce sites means any customer. That is a lower bar than it sounds, because registration is usually open. The effect is small, though. The record rates integrity impact as low and the others as none.
Missing authorization is a recurring pattern in plugins that add their own request handlers. Each handler needs its own check of who is calling, and one missed check is enough. Updating is the fix, and Patchstack's entry says it is unlikely to be exploited.
If your shop has open customer registration, treat every plugin with this class of bug as slightly more exposed than the score alone suggests.
Quick check
Do I need to be an administrator to trigger this?
No. The record lists low privileges required, which on a shop with open registration can be an ordinary customer account.
What name should I search for on my server?
The record and Patchstack use the HUSKY name, and Patchstack's link uses the plugin folder woocommerce-products-filter. Search for that folder name in wp-content/plugins.
Sources
Last reviewed: 19 October 2026.
