← Back to the live CVE advisory feed

CVE-2026-92969: HUSKY – Products Filter for WooCommerce Professional

Severity

8.1 (HIGH)

Vendor

REALMAG777

Affected versions

0 through 1.4.4

Patch status

Unknown

Published

2026-09-22T08:16:41.370

Modified

2026-09-22T11:17:26.650

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

View the official NVD record for CVE-2026-92969

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.