The HUSKY plugin for WordPress contains an unvalidated stored setting that gets concatenated into a file inclusion path. A user with the shop manager capability can manipulate this setting, causing the inclusion and execution of arbitrary local files on the server. The vulnerability is triggered on every front‑end request, even for unauthenticated visitors, which means the malicious inclusion can occur repeatedly without additional interaction once the setting is changed. The result is a local file inclusion that can lead to remote code execution, data exposure, or system compromise, depending on the files accessed.

Users of the HUSKY Products Filter Professional for WooCommerce WordPress plugin with any version earlier than 1.4.1 are affected. The plugin is installed on WordPress sites that grant shop manager privileges to one or more users.

The EPSS score is less than 1 %, indicating a low probability that an attacker has successfully exploited the flaw by the time of this analysis, although the vulnerability is serious. It is not listed in the CISA KEV catalogue, so no public exploit has been documented in that database. The attack vector is inferred to be a local‑file‑inclusion path traversal enabled by changing the plugin’s stored setting, which requires shop manager privileges but propagates to anonymous front‑end traffic. With the required capability, an attacker can potentially execute arbitrary PHP code on the server, compromising confidentiality, integrity, and availability.