A critical Local File Inclusion vulnerability in the HUSKY – Products Filter for WooCommerce Professional plugin allows unauthenticated attackers to execute arbitrary code on the underlying server.

This is a Local File Inclusion vulnerability (CWE-98) triggered via the shortcode parameter. The flaw is exploitable by unauthenticated attackers because the required security nonce is publicly exposed in the front-end source code.

Successful exploitation of this vulnerability allows an attacker to achieve full remote code execution on the host server. This could lead to a complete compromise of the WordPress installation, unauthorized access to sensitive customer data, and potential lateral movement within the hosting environment. With a CVSS score of 8.1, the high risk to data integrity and system availability necessitates immediate attention.

Immediate Action: Administrators should immediately deactivate or uninstall the plugin until a secure update is verified as available from the vendor. If the plugin is critical to operations, ensure that no untrusted files can be uploaded to the server, as these could be leveraged for inclusion.

Proactive Monitoring: Review web server access logs for requests containing suspicious shortcode parameters or attempts to access unexpected .php files. Monitor for unusual outbound network traffic or unexpected file modifications within the WordPress plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious local file inclusion patterns or unauthorized access attempts directed at the plugin endpoints.

Public Exploit Available: Unknown

Given the severity of potential remote code execution, organizations using this plugin must treat this vulnerability as a high priority. Until a patch is confirmed and applied, removing the vulnerable software is the only guaranteed method to eliminate the risk of unauthorized server access and data breach.