---
id: CVE-2026-92969
title: >-
  The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress
  is vulnerable to Local File Inclusion in all versions up to, and including,
  1.4.4 via the 'shortcode' parameter parameter
summary: >-
  The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress
  is vulnerable to Local File Inclusion in all versions up to, and including,
  1.4.4 via the 'shortcode' parameter parameter. This makes it possible for
  unauthent…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-98
vendor: realmag777
product: HUSKY – Products Filter for WooCommerce Professional
affected:
  - husky_products_filter_for_woocommerce_professional <= 1.4.4
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:04:55.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92969'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L1044
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L267
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L2677
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L2771
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L2789
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L3600
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3701864%40woocommerce-products-filter&new=3701864%40woocommerce-products-filter
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/1f71b558-e8c0-441e-b437-a7f30ad13513?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T10:09:49.016825Z'
ingestedAt: '2026-09-22T08:00:27.695Z'
epss: 0.0065
epssPercentile: 0.49797
---

## Overview

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.