CVE-2026-15244: HUSKY Products Filter Professional Local File Inclusion in meta_filter

CVE-2026-15244 · Severity: info · CVSS 7.2 · Published 2026-08-01

A vulnerability exists in the HUSKY Products Filter plugin for WooCommerce, which is used to provide advanced search and filtering for online stores. A user with 'Shop Manager' permissions can exploit a flaw in the plugin's settings to run malicious code or access sensitive files on the server. Once the malicious setting is saved, the code is automatically executed every time a visitor browses the store's front-end, potentially leading to a full site takeover or data theft.

Vendors: RealMag777.

Quick answers

Is CVE-2026-15244 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15244 being exploited in the wild.
How severe is CVE-2026-15244?
Informational severity, with a CVSS score of 7.2, published 1 August 2026.
Which products and versions are affected?
Unknown HUSKY – Products Filter Professional for WooCommerce < 1.4.1.
Is there a fix for CVE-2026-15244?
A patch was published on 2026-08-01: Patch availability confirmed in version 1.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15244 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15244?
Check whether you run RealMag777 HUSKY - Products Filter Professional for WooCommerce. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HUSKY (formerly WOOF) Products Filter Professional for WooCommerce plugin fails to sanitize the 'meta_filter search_view' setting against directory traversal sequences. An attacker with Shop Manager or higher privileges can inject traversal strings (e.g., ../../) into this stored setting. The plugin subsequently concatenates this value into a file inclusion path without validation. Because this setting is processed during front-end requests, the included file is executed or displayed to all visitors, including unauthenticated users. This can lead to Remote Code Execution (RCE) if the attacker can upload a file or leverage existing log files (log poisoning). The issue is fixed in version 1.4.1.

Affected products

  • Unknown HUSKY – Products Filter Professional for WooCommerce < 1.4.1

Timeline

  • 2026-07-17: disclosed
  • 2026-07-17: advisory
  • 2026-08-01: patched: Patch availability confirmed in version 1.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.