High priorityDisclosed

Advisory · CVE-2026-92969

HUSKY product filter exposes unauthenticated local file inclusion

An unauthenticated local file inclusion flaw in the HUSKY Products Filter for WooCommerce Professional plugin lets visitors include and execute arbitrary .php files via the 'shortcode' parameter, because the only nonce check uses a value emitted into every front-end page.

Advisory published September 22, 2026Independent summary
Vendor
realmag777
Product
HUSKY – Products Filter for WooCommerce Professional
Identifier / CWE
CVE-2026-92969
CWE-98
Action timing
Immediate
ELI5

Explain it like I’m five

The plugin checks visitors' IDs against a guest list, but it printed the secret password on a poster on the front door. Anyone can read the poster, walk in, and ask the site to open and run any PHP file on the server.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Public nonce

    The plugin emits the woof_front_nonce value into inline JavaScript on every front-end page, so any anonymous visitor can read it.

  2. 02Shortcode request

    The visitor crafts a request with a 'shortcode' parameter that passes the plugin's nonce check using the copied value.

  3. 03Local file inclusion

    The parameter is used to include a local file without sufficient validation, so an attacker-chosen .php file is pulled into the request.

  4. 04Code execution

    Including an attacker-reachable .php file lets the attacker bypass access controls, read sensitive data, or execute code on the server.

What happened

Wordfence disclosed an unauthenticated local file inclusion vulnerability in the HUSKY Products Filter for WooCommerce Professional plugin, rated high at CVSS 8.1. All versions up to and including 1.4.4 are affected.

The plugin’s request handler guards the shortcode parameter with a nonce check against woof_front_nonce. That nonce is printed into inline JavaScript on every front-end page, so it is public to any site visitor without authentication. With the nonce in hand, an unauthenticated attacker can trigger the inclusion path and have the server include and execute arbitrary .php files. That can be used to bypass access controls, obtain sensitive data, or achieve code execution where .php file types can be uploaded and included.

The vendor has not published a security advisory with a fixed version, so the safest reading is that any installation up to and including 1.4.4 remains at risk until updated.

What to do

  1. Update the HUSKY Products Filter plugin to the latest available release through the WordPress updater.
  2. Review web server and application logs for requests to the plugin’s filter endpoints with unusual shortcode parameter values.
  3. Check the uploads directory and other writable paths for unexpected .php files.
  4. Audit WooCommerce store data and credentials for signs of unauthorized access.
  5. If patching is delayed, disable the plugin’s front-end filtering features until the update is applied.

Management note

Unauthenticated file inclusion in a WooCommerce storefront plugin is a straight path from anonymous browsing to server compromise, and the store’s payment-adjacent data makes it worth more than the CVSS number alone suggests. Update first, then check for dropped files.