Local File Inclusion Vulnerability in HUSKY – Products Filter for WooCommerce Professional Plugin

CVE-2026-92969

What is CVE-2026-92969?

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion, allowing unauthenticated attackers to exploit the 'shortcode' parameter. This vulnerability enables the inclusion and execution of arbitrary .php files on the server, which can lead to serious security risks such as the bypassing of access controls, unauthorized data access, and the execution of harmful PHP code. The vulnerability arises from insufficient protections, as the only access control mechanism is a nonce check that is publicly available in inline JavaScript on every frontend page, exposing the site to potential threats from unauthenticated users.

References