What is the CVSS score of CVE-2026-15244?

CVE-2026-15244 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of HUSKY WordPress Plugin are affected by CVE-2026-15244?

The HUSKY WordPress plugin for WooCommerce (versions before 1.4.1) contains a local file inclusion flaw allowing authenticated shop managers to execute arbitrary PHP code on the server.. A patch is available.

Is there a public PoC exploit available for CVE-2026-15244?

Yes, a public proof-of-concept exploit is available for CVE-2026-15244. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-15244?

Within 24 hours, scan all WordPress infrastructure for HUSKY plugin deployments and document versions in use. Within 7 days, upgrade all instances to HUSKY version 1.4.1 or later, and reset shop manager account credentials to enforce fresh authentication. Within 30 days, audit access logs for suspicious activity during the vulnerable period, perform malware scans on affected servers, and validate that no unauthorized PHP files were created or executed.

HUSKY WordPress Plugin CVE-2026-15244

EUVD-2026-51718 HIGH

Path Traversal (CWE-22)

2026-08-01 WPScan

GHSA-2x64-p3rp-xpwq

WordPress Path Traversal Husky Unknown

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

PR:H reflects mandatory shop_manager authentication for the write step; S:U applies because impact remains within the same WordPress installation despite affecting all visitors.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:38 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

7.2 (HIGH)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 7.2

DescriptionCVE.org

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.

AnalysisAI

Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.

Technical ContextAI

HUSKY is a WooCommerce product filter plugin for WordPress. The vulnerability is a classic CWE-22 (Path Traversal) flaw where a plugin setting value - controllable by users holding the WordPress shop_manager capability - is concatenated directly into a PHP file inclusion path without sanitization or validation. Because PHP's include/require functions follow directory traversal sequences (e.g., '../../../'), an attacker can redirect inclusion to any file readable by the web server process, including sensitive configuration files or previously uploaded content. The CPE string cpe:2.3:a:unknown:husky:*:*:*:*:*:*:*:* covers all versions up to but not including 1.4.1. The critical amplifier is that the malicious inclusion is invoked on every front-end request, turning a once-privileged write into a persistent, unauthenticated execution primitive.

RemediationAI

The primary fix is to update the HUSKY plugin to version 1.4.1 or later, which introduces sanitization of the affected setting against directory traversal sequences. Plugin updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update. The vendor-released patch is confirmed available per WPScan advisory at https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/. As a compensating control prior to patching, restrict the shop_manager role assignment to only fully trusted accounts and audit existing shop managers for unauthorized additions. Additionally, review WordPress file system permissions to ensure the web server process cannot read sensitive files outside the web root, which would limit the impact of any successful traversal. Disabling the specific HUSKY setting that accepts the vulnerable input (if identifiable in the plugin UI) may serve as a temporary workaround, though the exact setting name is not confirmed in available data.