CVE-2026-15244
Received Received - Intake

Path Traversal in HUSKY WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15244
EUVD
EUVD-2026-51718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
husky wordpress_plugin to 1.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The HUSKY WordPress plugin before version 1.4.1 has a vulnerability where a stored setting value is not properly sanitized against directory traversal. This allows users with the shop manager capability to manipulate file paths, leading to the inclusion and execution of arbitrary local files. The issue is triggered on every front-end request, including for unauthenticated visitors.

Detection Guidance

Check if the HUSKY WordPress plugin version is below 1.4.1. Inspect plugin settings for unsanitized file paths. Review server logs for unauthorized file inclusion attempts or unusual file access patterns.

Impact Analysis

This vulnerability allows attackers with shop manager privileges to execute arbitrary local files on the server. This could lead to remote code execution, unauthorized data access, or complete system compromise. Unauthenticated visitors could also be affected as the malicious file inclusion occurs on every front-end request.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized data processing, or loss of data integrity, all of which are compliance violations.

Mitigation Strategies

Update the HUSKY WordPress plugin to version 1.4.1 or later. Remove or restrict shop manager capabilities if not required. Audit and sanitize all user-input file paths in plugin settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart