Malicious File Inclusion Vulnerability in HUSKY – Products Filter for WooCommerce (formerly WOOF)

CVE-2024-32680

Summary

A vulnerability exists within the PluginUS HUSKY – Products Filter for WooCommerce, specifically due to improper limitation of a pathname to a restricted directory. This vulnerability can be exploited through path traversal techniques, allowing attackers to access unauthorized directories and potentially execute arbitrary code. Additionally, it involves improper control over the generation of code, leading to opportunities for code injection attacks. Affected versions include all releases prior to 1.3.5.2, exposing sites using this plugin to significant security risks through the use of malicious files and unauthorized code inclusion.

References