CVE-2025-1661

CVE-2025-1661 is an unauthenticated local file inclusion (CWE-22) in the HUSKY – Products Filter Professional for WooCommerce WordPress plugin, affecting all versions up to and including 1.3.6.5. An attacker triggers it by sending a crafted request to the woof_text_search AJAX action with a path-traversal value in the 'template' parameter, causing the server to include an attacker-controlled file path. Because any PHP code in the included file is executed, an attacker can bypass access controls, read sensitive data, or achieve full code execution where the site allows uploading files that the server will execute (for example, uploadable 'safe' file types paired with include behavior). Any WordPress/WooCommerce site running HUSKY at version 1.3.6.5 or older is affected, with no authentication or user interaction required. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 56.4% EPSS score (99th percentile) indicates a high likelihood of exploitation attempts within 30 days.

What to do: Update HUSKY to the first release after 1.3.6.5 and verify the patched version in the plugin changelog. As interim mitigation, restrict or block unauthenticated POST requests to admin-ajax.php with action=woof_text_search (or apply WAF rules constraining the 'template' parameter against '../' traversal), and audit upload directories for files that could be included and executed. Review access logs for anomalous woof_text_search requests containing path-traversal patterns.