Critical · published March 11, 2025
CVSS calls it critical at 9.8. It sits in the 99.1th percentile for exploit probability.
🔥 A sneaky local file inclusion flaw lurking in the HUSKY WooCommerce plugin opens up a treasure chest for attackers! 🚨 Think of it like a delivery service that accidentally accepts packages without checking their contents, allowing anyone to slip in potentially dangerous materials. This vulnerability lets attackers include any file on the server, bypassing security and executing malicious PHP code without breaking a sweat. With this exploit, an attacker could gain full control of the server, access sensitive data, or execute any PHP code they desire. Imagine the chaos of unauthorized access, leading to data breaches or even complete server takeover! This is absolutely devastating for any WooCommerce store.
Think of it like a delivery service that accidentally accepts packages without checking their contents, allowing anyone to slip in potentially dangerous materials. This vulnerability lets attackers include any file on the server, bypassing security and executing malicious PHP code without breaking a sweat. The vulnerability stems from the 'template' parameter in the woof_text_search AJAX action, which fails to properly validate input. This allows unauthenticated users to include arbitrary files, effectively executing any PHP code contained within those files.
With this exploit, an attacker could gain full control of the server, access sensitive data, or execute any PHP code they desire. Imagine the chaos of unauthorized access, leading to data breaches or even complete server takeover! This is absolutely devastating for any WooCommerce store. Immediately update the HUSKY – Products Filter Professional plugin to version 1.3.6.6 or later to close this security gap. Additionally, review your server's file permissions and implement stricter input validation to mitigate similar risks in the future. You've got this! Take these steps and you'll secure your WooCommerce store in no time. 🛡️