EUVD-2026-84299
GHSA-chrw-gf4w-fmg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad front-end page, scrape woof_front_nonce
-
DeliverySend request with malicious 'shortcode' path
-
ExploitTrigger PHP file inclusion in plugin handler
-
ExecutionInclude attacker-plantable or sensitive .php file
-
ImpactExecute PHP code / exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable by unauthenticated remote users against default configurations: the plugin's shortcode-rendering endpoint accepts a 'shortcode' parameter guarded only by a woof_front_nonce that is publicly emitted in inline JavaScript on every front-end page, so any visitor can obtain it. The plugin (HUSKY/WOOF - Products Filter for WooCommerce Professional, versions <=1.4.4) must be installed and active on a WooCommerce site. Full arbitrary code execution (as opposed to inclusion of existing .php files for access-control bypass or data disclosure) additionally requires an attacker-controllable .php file to exist on the server (e.g. via an upload feature, log poisoning, or session files), which is the primary factor limiting worst-case impact. |
| Impact | This is a genuine high-priority issue rather than a high-CVSS paper tiger. The CVSS 3.1 vector (AV:N/AC:L equivalent network reachability, PR:N, UI:N, C:H/I:H/A:H) and CWE-98 (PHP remote/local file inclusion) describe an unauthenticated file-inclusion flaw in a front-end WooCommerce filtering plugin, and the description confirms the only gate - a woof_front_nonce nonce check - is publicly emitted into inline JavaScript on every front-end page, so it is not a real access control. Wordfence assigned AC:H, which appears to reflect that reliable *arbitrary code execution* depends on an includable .php payload already existing on disk (upload path, log poisoning, session files, etc.); pure inclusion of existing server .php files is straightforward once the nonce is scraped, so the network complexity is arguably lower than AC:H suggests. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced in the provided data; the only sources are the Wordfence advisory and WordPress.org trac line references/changeset. The combination of unauthenticated reach, trivially bypassable nonce, and a very common WooCommerce plugin class makes this worth prioritizing for patching, but the absence of a published POC and the AC:H caveat mean it is not yet demonstrably mass-exploited. |
| Exploit ScenarioDerived | An unauthenticated visitor loads any front-end page, scrapes the woof_front_nonce value from the inline JavaScript, then sends a request to the plugin's shortcode handler with the 'shortcode' parameter pointed at a local .php path. The included file executes in the WordPress PHP context, disclosing configuration/secrets or, where an attacker can plant a .php payload (upload, log, or session file), achieving remote code execution. No public POC is referenced, but the nonce-scraping step is trivial and the attack requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
RemediationAI
Vendor-released patch: upstream fix available (PR/commit per Trac changeset 3701864); a released patched version number above 1.4.4 is not independently confirmed in the supplied data, so administrators should update the plugin through the WordPress dashboard or the WooCommerce/plugin vendor distribution channel and then verify the installed version is strictly greater than 1.4.4, cross-checking the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1f71b558-e8c0-441e-b437-a7f30ad13513?source=cve and the Trac changeset https://plugins.trac.wordpress.org/changeset?reponame=&old=3701864%40woocommerce-products-filter&new=3701864%40woocommerce-products-filter for the exact fixed build. If the plugin cannot be updated immediately, the most effective compensating control is to deactivate it entirely, since the nonce guard (woof_front_nonce) is published in inline JavaScript on every front-end page and therefore cannot be used to restrict access; the trade-off is loss of the product-filter functionality on the WooCommerce storefront. Where deactivation is unacceptable, block requests carrying a 'shortcode' parameter that reach the plugin's handler (via WAF or reverse-proxy rule) and reject path-traversal sequences in that parameter, accepting that this is a partial control that may be bypassed by encoding tricks. Because worst-case impact depends on an attacker-controllable .php file already existing on the server, harden the include surface by disabling any WordPress upload of .php files, enforcing strict upload MIME/extension allowlists, and ensuring logs and session directories are not writable or web-includable; each measure reduces the LFI-to-RCE escalation path but adds operational friction for legitimate file uploads. Finally, monitor web-server logs for anomalous include attempts and treat any suspicious POST/GET to the filter shortcode endpoint as a potential compromise indicator requiring credential rotation and file-integrity review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, i.e. PHP remote/local file inclusion). HUSKY - Products Filter for WooCommerce Professional is a commercial WordPress/WooCommerce plugin (distributed via the WordPress.org Trac repository 'woocommerce-products-filter' and identified by CPE cpe:2.3:a:realmag777:husky_-_products_filter_for_woocommerce_professional with an unconstrained version wildcard). The plugin renders filter output through a shortcode handler; the 'shortcode' parameter is passed into a PHP include/require path without adequate sanitisation, so an attacker can traverse the filesystem and cause the PHP interpreter to load and execute an arbitrary file. Because the required file is resolved as a local path rather than a remote URL, the immediate primitive is local file inclusion: it can bypass access controls and read/execute existing server-side .php content, and escalates to arbitrary code execution only when a file with attacker-controlled PHP content is already present on disk. The plugin attempts to gate the shortcode path behind a nonce ('woof_front_nonce'), but the nonce is printed into inline JavaScript on every front-end page, so it provides no meaningful protection against unauthenticated visitors. The referenced Trac source lines (index.php lines 267, 1044, 2677, 2771, 2789, 3600) and changeset 3701864 correspond to the affected code paths and the upstream fix respectively.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network LFI (PR:N, UI:N) with the nonce trivially bypassable; AC:H retained because reliable arbitrary code execution requires an includable attacker-plantable .php file, and inclusion yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The HUSKY - Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.
Articles & Coverage 1
Executive ViewAI
HUSKY - Products Filter for WooCommerce Professional, a WordPress plugin used by WooCommerce sites through version 1.4.4, is affected by an unauthenticated local file inclusion flaw that can expose sensitive data and, under specific server conditions, enable remote code execution. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis. Leadership should treat this as a high-priority risk because any site visitor can trigger the flaw, requiring immediate inventory, containment, and vendor follow-up.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate/remove the affected plugin; virtual-patch via WAF/IPS blocking malicious 'shortcode' parameters (path traversal, php://filter, arbitrary file paths); restrict/audit uploads and eliminate attacker-controllable .php files; monitor logs for LFI/RCE attempts; apply least privilege and file-integrity monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB