An improper control of filename in the RealMag777 HUSKY WooCommerce Products Filter plugin allows local file inclusion when an attacker supplies a crafted input to the include/require statement. The flaw can be leveraged to read arbitrary files on the server or execute malicious PHP code uploaded by an adversary, which in turn can lead to full site compromise and loss of confidentiality, integrity, and availability.

WordPress sites that have installed the RealMag777 HUSKY WooCommerce Products Filter plugin, specifically versions up to and including 1.3.7. The vulnerability applies to any instance of the plugin from its first release through version 1.3.7.

The CVSS score of 7.5 indicates a significant risk, while the EPSS score of less than 1% suggests that exploitation has not been widely observed yet. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based request that can manipulate the file path used by the plugin’s include function; the attacker could traverse directories or supply a local file path to read sensitive data or execute arbitrary code if the server permits PHP execution of the chosen file.