Log in / Sign up

Vulnerability details

CVE-2026-92969

RealMag777 HUSKY – Products Filter for WooCommerce Professional

HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX

CVSS 3.1
8.1High

Official description

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

CVSS scores

ScoreVersionSourceVector
8.1High 3.1 CVEProject cvelistV5 (CNA) (Wordfence) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
RealMag777 HUSKY – Products Filter for WooCommerce Professional v ≤ 1.4.4 CVEProject cvelistV5 (CNA)

References and advisories

8
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-22
Last updated
2026-09-22
State
Published
Assigner (CNA)
Wordfence

Exploit prediction (EPSS)

0.81%
Probability of exploitation in 30 days
57.3%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-98
    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')