Executive brief
HUSKY Products Filter is a WordPress plugin that displays filtered product catalogs for online stores. An unauthenticated attacker can exploit a flaw in the plugin to include and execute arbitrary PHP files on the server, potentially leading to complete site compromise, data theft, or installation of malware. The vulnerability is easily exploitable because the security token (nonce) used to protect the feature is publicly visible in every web page's source code.
Technical details
The plugin contains a local file inclusion vulnerability in the shortcode handler via an insufficiently validated 'shortcode' parameter. The vulnerability is reachable by unauthenticated attackers because the nonce validation uses woof_front_nonce, which is embedded in public-facing JavaScript and therefore obtainable without authentication. Successful exploitation allows arbitrary PHP code execution on the server, potentially circumventing file upload restrictions and access controls.
Affected products
- HUSKY Products Filter for WooCommerce Professional up to and including 1.4.4
Timeline
- 2026-09-22: disclosed