Description

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-22T08:16:41.370Z",
  "pubdate": "2026-09-22T08:16:41.370Z",
  "executiveSummary": "The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress, in versions up to and including 1.4.4, contains a critical Local File Inclusion (LFI) vulnerability. This security flaw allows unauthenticated remote attackers to include and execute arbitrary PHP files residing on the target server. By leveraging insufficient access controls, an adversary can bypass security restrictions to execute malicious code, potentially leading to full site compromise.\nThe vulnerability originates from a flawed security validation mechanism involving a nonce check. Since the required nonce is exposed via inline JavaScript on the front-end to all site visitors, authentication is not a prerequisite for exploitation. The impact is severe, granting attackers the ability to achieve Remote Code Execution (RCE) if they can successfully place a malicious payload on the server (e.g., via file uploads or log poisoning) and reference it through the affected parameter. Organizations using this plugin are at risk of data exfiltration, unauthorized access, and complete server control.",
  "technicalDetails": "The vulnerability is situated within the request handling logic of the HUSKY – Products Filter for WooCommerce Professional plugin, specifically involving the 'shortcode' parameter. The plugin fails to properly sanitize or restrict user-supplied input before passing it to internal file inclusion functions. This lack of path validation enables directory traversal and arbitrary file inclusion, allowing an attacker to load and interpret unauthorized PHP scripts.\nThe root cause of the broken access control is an ineffective nonce-based verification mechanism. The plugin relies on the 'woof_front_nonce' to authenticate requests; however, this nonce is rendered globally within the HTML source code of the front-end pages via inline JavaScript. Consequently, any visitor, regardless of their authenticated status, can retrieve the valid nonce required to pass the plugin's security check. This makes the vulnerability fully exploitable by unauthenticated remote attackers.\nThe attack flow proceeds as follows: First, the attacker visits the target WordPress site to scrape the 'woof_front_nonce' from the document object model (DOM) or source code. Second, the attacker crafts a malicious request targeting the vulnerable endpoint, supplying the harvested nonce in the request parameters. Third, the attacker injects a path into the 'shortcode' parameter pointing to a target file. If the attacker has previously uploaded a PHP file through an auxiliary vector or can influence log files, they can point the LFI vector to these locations. The server then processes the request, includes the specified file, and executes the embedded PHP code within the context of the web server process.\nPost-exploitation impact includes complete remote code execution, which permits the attacker to manipulate the underlying WordPress database, modify site content, exfiltrate sensitive customer data, or establish persistence via backdoors. Given the nature of LFI, the attacker is not strictly limited to existing site files if they can leverage secondary techniques to place code on the filesystem. This vulnerability affects all versions up to and including 1.4.4, requiring immediate defensive intervention to neutralize the exposed entry point."
}