# CVE-2026-15244: HUSKY Products Filter Professional Local File Inclusion in meta_filter

Source: https://junglewise.ai/threats/cve-2026-15244-husky-products-filter-professional-local-file-inclusion-in-meta  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-15244 · Severity: info · CVSS 7.2 · Published 2026-08-01

A vulnerability exists in the HUSKY Products Filter plugin for WooCommerce, which is used to provide advanced search and filtering for online stores. A user with 'Shop Manager' permissions can exploit a flaw in the plugin's settings to run malicious code or access sensitive files on the server. Once the malicious setting is saved, the code is automatically executed every time a visitor browses the store's front-end, potentially leading to a full site takeover or data theft.

Vendors: [RealMag777](https://junglewise.ai/threats/vendors/realmag777).

## Quick answers

**Is CVE-2026-15244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15244 being exploited in the wild.

**How severe is CVE-2026-15244?** Informational severity, with a CVSS score of 7.2, published 1 August 2026.

**Which products and versions are affected?** Unknown HUSKY – Products Filter Professional for WooCommerce < 1.4.1.

**Is there a fix for CVE-2026-15244?** A patch was published on 2026-08-01: Patch availability confirmed in version 1.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15244 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15244?** Check whether you run RealMag777 HUSKY - Products Filter Professional for WooCommerce. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HUSKY (formerly WOOF) Products Filter Professional for WooCommerce plugin fails to sanitize the 'meta_filter search_view' setting against directory traversal sequences. An attacker with Shop Manager or higher privileges can inject traversal strings (e.g., ../../) into this stored setting. The plugin subsequently concatenates this value into a file inclusion path without validation. Because this setting is processed during front-end requests, the included file is executed or displayed to all visitors, including unauthenticated users. This can lead to Remote Code Execution (RCE) if the attacker can upload a file or leverage existing log files (log poisoning). The issue is fixed in version 1.4.1.

## Affected products

- Unknown HUSKY – Products Filter Professional for WooCommerce < 1.4.1

## Timeline

- 2026-07-17: disclosed
- 2026-07-17: advisory
- 2026-08-01: patched: Patch availability confirmed in version 1.4.1

## References

- [https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/](https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/)