CVE-2025-1661: Unauthenticated Local File Inclusion in HUSKY Products Filter for WooCommerce (CVSS 9.8)

If your WooCommerce store uses a product filter to help shoppers narrow down results by color, size, price, or category, there is a good chance you are relying on one of the most popular filtering plugins on the market: HUSKY – Products Filter Professional for WooCommerce (formerly known as WOOF). In March 2025, security researchers disclosed a critical flaw in this plugin that let anyone on the internet — no login, no account, no special access — trick the plugin into loading and running arbitrary files on your server. Tracked as CVE-2025-1661 and rated a maximum-severity 9.8 out of 10, this is exactly the kind of vulnerability that turns a routine online store into a compromised server.

If you run a WooCommerce shop, this one deserves your attention. Here is what the flaw is, how it works in plain language, and what you need to do about it.

CVE Details at a Glance

• CVE ID: CVE-2025-1661
• Plugin: HUSKY – Products Filter Professional for WooCommerce (plugin slug woocommerce-products-filter, by realmag777 / Pluginus)
• Vulnerability type: Local File Inclusion (LFI), classified under CWE-22 (Path Traversal)
• CVSS 3.1 score: 9.8 (Critical) — vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Authentication required: None — exploitable by unauthenticated attackers
• Affected versions: All versions up to and including 1.3.6.5
• Patched version: 1.3.6.6
• Disclosed: March 11, 2025 (via Wordfence)

The three “High” impact ratings for confidentiality, integrity, and availability tell the whole story: a successful attack can read your data, alter your site, and take it offline. Because no privileges and no user interaction are required, the barrier to exploitation is effectively zero.

How the Vulnerability Works

Local File Inclusion is a class of vulnerability where an application is tricked into loading a file whose path is controlled by the attacker. In PHP-based software like WordPress, “loading” a file often means executing it — so if an attacker can point the application at a file that contains PHP code, that code runs with the permissions of the web server.

In HUSKY’s case, the weak spot is the plugin’s live text-search feature. The plugin registers an AJAX action called woof_text_search, which handles search-as-you-type requests from the storefront. That handler accepts a parameter named template and uses its value to decide which template file to include and render. The problem is that the plugin did not properly validate or restrict that parameter. An attacker could supply a crafted value — using directory traversal sequences like ../ — to walk out of the intended template folder and point the plugin at a completely different file on the server.

Because the woof_text_search action is available to unauthenticated visitors (it has to be, so that anonymous shoppers can use the search box), an attacker does not need an account. They simply send a specially crafted request to your site’s admin-ajax.php endpoint with a malicious template value, and the plugin does the rest.

On its own, LFI lets an attacker read files that should never be exposed. But the more dangerous scenario is combining it with any way of getting attacker-controlled content onto the server — for example, uploading a seemingly harmless image file that secretly contains PHP code, or poisoning a log file or PHP session file with malicious input. Once such a file exists somewhere on disk, the LFI flaw becomes a path to full remote code execution. That is why researchers describe this bug as capable of “the execution of any PHP code” on the server.

Real-World Impact

For an e-commerce store, the consequences of this kind of flaw are severe and very concrete:

• Theft of sensitive configuration data. An attacker can read wp-config.php, which contains your database credentials, authentication keys, and salts — effectively the keys to your entire WordPress installation.
• Full server compromise. When chained with a file upload or log-poisoning technique, the flaw allows arbitrary PHP execution, letting attackers install web shells, backdoors, and persistent malware.
• Customer data exposure. WooCommerce databases hold order histories, names, addresses, email addresses, and phone numbers. A breach here can trigger data-protection obligations and destroy customer trust.
• Payment and checkout tampering. With code execution, attackers can inject card-skimming scripts (Magecart-style attacks) into your checkout to silently steal payment details from real customers.
• Site defacement or downtime. The “High” availability impact means an attacker can take the store offline entirely, directly costing you sales.

Multiple proof-of-concept exploits for CVE-2025-1661 have been published publicly on GitHub, which means the technical barrier to weaponizing this flaw is low. Automated scanners routinely sweep the web looking for vulnerable plugin versions, so an unpatched store can be found and attacked without anyone specifically targeting it.

How to Check If You’re Affected

You are potentially affected if your site runs HUSKY – Products Filter Professional for WooCommerce (or its older “WOOF – Products Filter for WooCommerce” branding) at version 1.3.6.5 or earlier. Here is how to confirm:

1. Log in to your WordPress dashboard and go to Plugins → Installed Plugins.
2. Look for “HUSKY – Products Filter Professional for WooCommerce” (it may still appear as “WOOF” on older installs).
3. Check the version number listed under the plugin name. If it is 1.3.6.5 or lower, your site is vulnerable.
4. If you are not sure whether the plugin is installed at all, search your plugins list for “filter” or check for the woocommerce-products-filter folder inside wp-content/plugins/.

If your site has been unpatched for a while, it is worth checking for signs of compromise too: unexpected new files in your uploads or plugins directories, unfamiliar admin accounts, unexplained outbound traffic, or modified core files. A malware scanner can help surface these.

How to Fix It

The fix is straightforward and should be treated as urgent: update the plugin to version 1.3.6.6 or later immediately. The plugin’s developers patched the flaw by properly validating and restricting the template parameter so it can no longer be used to reach arbitrary files.

1. In your WordPress dashboard, go to Plugins → Installed Plugins.
2. Find HUSKY – Products Filter Professional for WooCommerce and click Update Now (or Enable auto-updates if available).
3. If you use the premium version and do not see an update, log in to your account with the plugin vendor to download the latest release, then upload it manually.
4. After updating, confirm the version now reads 1.3.6.6 or higher.

Beyond the update itself, a few hardening steps reduce your exposure to this entire class of attack:

• Enable a web application firewall (WAF). A good WAF can block directory-traversal payloads and known exploit patterns before they reach the vulnerable code — useful as virtual patching while you schedule updates.
• Restrict PHP execution in the uploads directory. Preventing PHP from running inside wp-content/uploads/ defuses the most common LFI-to-RCE chain.
• Keep everything updated. Enable automatic updates for plugins and themes where practical, and remove any plugins you no longer use.
• Run regular malware scans. If your store was exposed for any length of time, scan to make sure nothing was left behind.

Takeaway

CVE-2025-1661 is a textbook example of how a single unvalidated parameter in a widely used plugin can put an entire online store at risk. The feature at the heart of it — a product search box — is completely ordinary, which is precisely why flaws like this are so dangerous: they hide in functionality you use every day and never think twice about.

The good news is that the defense is equally ordinary: patch promptly, limit what your server is allowed to execute, and put a firewall between your site and the open internet. Treat every plugin as attack surface, keep them current, and you turn critical vulnerabilities like this one from an emergency into a non-event. If you run HUSKY on a WooCommerce store, update to 1.3.6.6 today — and while you are in there, make sure the rest of your plugins are current too.