Executive brief
A vulnerability exists in the HUSKY Products Filter plugin for WooCommerce, which is used to provide advanced search and filtering for online stores. A user with 'Shop Manager' permissions can exploit a flaw in the plugin's settings to run malicious code or access sensitive files on the server. Once the malicious setting is saved, the code is automatically executed every time a visitor browses the store's front-end, potentially leading to a full site takeover or data theft.
Technical details
The HUSKY (formerly WOOF) Products Filter Professional for WooCommerce plugin fails to sanitize the 'meta_filter search_view' setting against directory traversal sequences. An attacker with Shop Manager or higher privileges can inject traversal strings (e.g., ../../) into this stored setting. The plugin subsequently concatenates this value into a file inclusion path without validation. Because this setting is processed during front-end requests, the included file is executed or displayed to all visitors, including unauthenticated users. This can lead to Remote Code Execution (RCE) if the attacker can upload a file or leverage existing log files (log poisoning). The issue is fixed in version 1.4.1.
Affected products
- Unknown HUSKY – Products Filter Professional for WooCommerce < 1.4.1
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory
- 2026-08-01: patched: Patch availability confirmed in version 1.4.1