CVE-2026-92969

Name of the Vulnerable Software and Affected Versions HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.5

Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. Unauthenticated attackers can exploit this via the shortcode parameter to include and execute arbitrary .php files on the server. This can lead to the execution of PHP code, bypassing of access controls, or the theft of sensitive data. The issue exists because the access control relies on a nonce check against woof front nonce, which is publicly exposed in inline JavaScript on all front-end pages, making it accessible to any visitor.

Recommendations Update to a version newer than 1.4.4. Restrict the use of the shortcode parameter until the update is applied.