Arbitrary File Inclusion Vulnerability in HUSKY Products Filter Professional for WooCommerce Plugin

CVE-2024-3061

Summary

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is exposed to a Local File Inclusion vulnerability due to improper validation of the 'type' parameter. This vulnerability affects all versions up to and including 1.3.5.2, granting authenticated users with administrator-level access the ability to include and execute arbitrary files on the server. Exploitation of this vulnerability can lead to unauthorized access to sensitive data, exploitation of access controls, and the execution of malicious PHP code from uploaded files. Such risks underscore the need for immediate patching and careful management of permissions within WordPress installations utilizing this plugin.

References