CVE-2025-1661
Description
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
How to fix
- pluginus husky_-_products_filter_professional_for_woocommerce1.3.6.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pluginus husky_-_products_filter_professional_for_woocommerce | v < 1.3.6.6 | 1.3.6.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.