CVE-2026-92969
Received Received - Intake

Local File Inclusion in HUSKY Products Filter for WooCommerce

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-92969
EUVD
EUVD-2026-84299

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
husky products_filter_for_woocommerce_professional to 1.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Local File Inclusion (LFI) flaw in the HUSKY – Products Filter for WooCommerce Professional plugin for WordPress. It affects versions up to 1.4.4 and is triggered via the 'shortcode' parameter. Unauthenticated attackers can exploit this to include and execute arbitrary .php files on the server, enabling PHP code execution. The only barrier is a nonce check against woof_front_nonce, which is publicly exposed in inline JavaScript on every front-end page, making it easily obtainable by any visitor.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the HUSKY – Products Filter for WooCommerce Professional plugin versions up to 1.4.4. Check server logs for unusual file inclusion attempts via the 'shortcode' parameter. Use commands like grep to search for patterns in access logs: grep -i 'shortcode=' /var/log/apache2/access.log or similar paths for your web server.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary PHP code on your server. This could lead to unauthorized access to sensitive data, bypassing security controls, or taking full control of your WordPress site. Attackers might steal user data, deface your website, or use your server for malicious activities like hosting malware or launching further attacks.

Compliance Impact

This vulnerability could lead to severe compliance violations. For GDPR, unauthorized access to personal data may result in fines for failing to protect user information. For HIPAA, exposure of protected health information could lead to significant penalties. Both standards require strict data protection measures, and a breach like this would likely violate their requirements.

Mitigation Strategies

Immediately update the HUSKY – Products Filter for WooCommerce Professional plugin to the latest version beyond 1.4.4. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Review server file permissions to restrict PHP file execution in upload directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart