The HUSKY – Products Filter for WooCommerce Professional WordPress plugin contains a Local File Inclusion flaw in all releases up to and including 1.4.4. An unauthenticated attacker can supply an arbitrary file path via the shortcode parameter, causing the plugin to include and execute that file on the server. This flaw allows execution of any PHP code carried in the target file, enabling attackers to bypass access controls, read sensitive data, or fully compromise the site. The vulnerability maps to CWE‑98, a typical file inclusion weakness.

WordPress sites running the HUSKY – Products Filter for WooCommerce Professional plugin, vendor realmag777, on any version 1.4.4 or earlier are vulnerable. Updating to a version newer than 1.4.4 or removing the plugin eliminates the issue.

The CVSS score of 8.1 classifies this issue as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Proof of concept suggests the flaw can be triggered by any unauthenticated user, as the sole access control is a nonce emitted in inline JavaScript on every front‑end page. Attackers can obtain the nonce by browsing the website, construct the malicious shortcode, and trigger the vulnerable AJAX endpoint to include arbitrary files.