HUSKY WordPress Plugin CVE-2026-15244

Initial exploitation requires the attacker to be authenticated with the WordPress shop_manager capability (or higher, such as administrator). The vulnerability is triggered when the attacker saves a crafted directory traversal value in the specific HUSKY plugin setting that is later concatenated into a PHP file inclusion path. After this one-time privileged write, the malicious inclusion fires on every front-end HTTP request, including unauthenticated GET requests from regular site visitors, with no further attacker interaction required. Limiting factors: (1) the shop_manager role must be held - this is not exploitable by subscribers, contributors, or unauthenticated users at the write stage; (2) the included file must already exist on the local filesystem and be readable by the web server process - arbitrary remote file inclusion is not indicated; (3) for maximum impact (RCE), an attacker typically must first place a malicious file on the server (e.g., via file upload functionality), unless sensitive PHP files already on disk are sufficient.

The CVSS 3.1 score of 7.2 (PR:H) correctly reflects that initial exploitation requires shop manager credentials, which limits opportunistic mass exploitation. However, the real-world risk is higher than the raw score suggests in WooCommerce environments: shop manager is a role routinely delegated to non-technical store staff, third-party fulfillment partners, or compromised via credential stuffing on e-commerce sites. Once exploited, the impact is full CIA triad compromise (C:H/I:H/A:H) with no further privileged interaction needed. EPSS at 0.50% (40th percentile) indicates low current automated exploitation probability, but the existence of a public POC reported by WPScan meaningfully elevates targeted attack risk. No CISA KEV listing is present, so confirmed active exploitation is not established. The CVSS vector is internally consistent - AV:N and PR:H are not in conflict, as the shop manager sets the payload remotely via the admin interface. The primary limiting factor is the shop_manager prerequisite; organizations without that role delegated broadly face lower realistic risk.

An attacker who has obtained shop manager credentials - through credential stuffing, phishing, or insider access - navigates to the HUSKY plugin settings in the WordPress admin panel and inserts a directory traversal payload (e.g., ../../../../uploads/malicious.php) into the vulnerable configuration field. After saving, every subsequent HTTP request to the site's front end - including anonymous visitors - triggers the web server to include and execute the targeted local file, achieving persistent remote code execution without further attacker interaction. A public proof-of-concept for this exploitation path is available via WPScan.