CVE-2025-1661
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the...
Affects 1 product across 1 vendor.
Attacker manipulates file path inputs to access files outside the intended directory.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI) via the 'template' parameter of the woof_text_search AJAX action. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server, leading to potential code execution, data exfiltration, and access control bypass. The CVSS score is 9.8, indicating a critical severity level. A public proof of concept (PoC) is available, increasing the risk of exploitation. Immediate action is required to mitigate this vulnerability in affected environments.
BSID: BS-2025-GLOBAL-270347-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-1661?
What is the CVSS score for CVE-2025-1661?
Is CVE-2025-1661 actively exploited?
How do I remediate CVE-2025-1661?
What systems are affected by CVE-2025-1661?
What NERC-CIP standard applies to CVE-2025-1661?
What IEC 62443 requirement maps to CVE-2025-1661?
| CVE ID | CVE-2025-1661 |
|---|---|
| BSID | BS-2025-GLOBAL-270347-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2025-03-11 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the 'template' parameter of the woof_text_search AJAX action, which is not properly validated. An unauthenticated attacker can manipulate this parameter to include and execute arbitrary files on the server. This can lead to the execution of PHP code, allowing the attacker to perform actions such as data exfiltration, code execution, and bypassing access controls. The attack can be performed remotely over the network without any user interaction.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Pluginus | Husky - Products Filter Professional For Woocommerce | < 1.3.6.6 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization for the 'template' parameter in the woof_text_search AJAX action. Additionally, restrict file permissions to prevent unauthorized access to sensitive files.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2 by allowing unauthorized access to the system, which can lead to the compromise of critical cyber assets and the potential for unauthorized control of the system.
This vulnerability maps to SR 7.6, which requires the implementation of secure coding practices to prevent vulnerabilities such as Local File Inclusion. The vulnerability allows an attacker to execute arbitrary code, which can compromise the integrity and availability of the system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | b49feeda0851b5ce14af5b00f9b012ef9562f5786f4cafce87ac40d2db9615351e25d25bb668519b4ed4319ac774e40b27f5a360f6fbb32a9f46f11a41a29449 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →