The HUSKY – Products Filter Professional for WooCommerce plugin includes a Local File Inclusion flaw in the ‘template’ parameter of the woof_text_search AJAX action. An attacker can supply a path that causes the server to read and execute any file on the file system, including files uploaded by the site owner. This allows execution of arbitrary PHP code, enabling full compromise of the site, data exfiltration, and bypassing of access controls.

WordPress sites running the HUSKY – Products Filter Professional for WooCommerce plugin from realmag777 with any version up to and including 1.3.6.5 are affected. No additional products or versions are listed.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of 93% shows a very high likelihood of exploitation. Although not yet listed in CISA KEV, the vulnerability can be exploited remotely via an unauthenticated AJAX request that sets the ‘template’ parameter. Successful exploitation allows an attacker to include any local file, such as uploaded images that contain PHP code, and thus achieve arbitrary code execution on the server.