The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to a local file inclusion flaw located in the ‘template’ parameter of the woof_text_search AJAX action. An attacker can supply an arbitrary file path that is not properly sanitized, causing the server to include and execute the contents of that file. If the referenced file contains PHP code, the code will run on the server, enabling the attacker to gain code execution on the affected site, potentially bypass access controls, read sensitive data, or deploy additional malicious content.

WordPress sites that are running the HUSKY – Products Filter Professional for WooCommerce plugin from realmag777 with any version up to and including 1.3.6.5 are affected. No other vendors or products are listed as impacted.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of 56% suggests a high likelihood of exploitation. This vulnerability can be taken advantage of by sending an unauthenticated request to the woof_text_search AJAX action with a custom value for the ‘template’ parameter. Because the plugin fails to validate or sanitize this value, the server will attempt to include the file located at the supplied path. If the referenced file contains PHP code, the code is executed in the context of the web server, potentially granting the attacker remote code execution. Although the description does not explicitly mention uploading a malicious file, based on the functionality, it is inferred that an attacker could place a PHP file in a directory that is already writable via the plugin’s image‑upload mechanism and subsequently use the LFI path to execute it. This provides the attacker with a full code‑execution path.