CVE-2025-1661

What it actually does

This vulnerability is an unauthenticated local file inclusion issue in the HUSKY – Products Filter Professional for WooCommerce WordPress plugin in versions up to and including 1.3.6.5. The vulnerable AJAX handler, woof_text_search, accepts a template parameter that can be manipulated to include arbitrary local files from the web server. If an attacker can cause a PHP-interpretable file to exist on the server, such as through media upload functionality, writable cache locations, log poisoning, or another upload path, the included file may execute as PHP in the context of the WordPress application. Technical outcomes can include arbitrary PHP code execution, disclosure of local files, bypass of WordPress access controls, credential theft from configuration files, web shell deployment, plugin/theme tampering, and full compromise of the WordPress site and its underlying hosting account.

Why it matters to the business

A successful attack can allow an unauthenticated internet-based attacker to take over an affected WooCommerce site, steal customer or order data, modify product listings, inject malicious checkout content, redirect visitors, send spam, or use the server as infrastructure for further attacks. Because this affects an e-commerce plugin and has a critical CVSS score, a high EPSS score, and weaponized exploit maturity, exposed sites should be treated as high-priority even though the issue is not currently listed in CISA KEV. Operational consequences may include storefront downtime, payment-flow manipulation, reputational damage, regulatory notification obligations, incident response costs, and loss of customer trust.

How an attack unfolds

An attacker first identifies a WordPress site running the vulnerable HUSKY – Products Filter Professional for WooCommerce plugin. They then send unauthenticated requests to the WordPress AJAX endpoint using the woof_text_search action and a crafted template value that references a local file. In the simplest case, the attacker may attempt to read or include sensitive local application files. To achieve code execution, the attacker typically needs a PHP-executable payload to already exist on disk or must create one indirectly, for example by uploading a file through available media or form functionality, abusing writable plugin/theme/cache directories, or poisoning a log file that can later be included. Once the file is included by the vulnerable handler, the PHP code executes under the web server account. The attacker can then establish persistence, deploy a web shell, create administrator users, extract database credentials from WordPress configuration, access the WooCommerce database through the application, modify checkout or payment behavior, and pivot to the hosting environment.

How to fix it

Upgrade the HUSKY – Products Filter Professional for WooCommerce plugin to a version newer than 1.3.6.5 that contains the vendor fix. If a fixed version is not available through the WordPress plugin update channel, disable and remove the plugin until a patched release can be installed. Restrict or disable unauthenticated access to vulnerable AJAX functionality where feasible using a web application firewall or server-side rule, but treat this only as temporary mitigation. Harden WordPress by disabling direct PHP execution in upload directories, limiting file write permissions for the web server account, disabling the built-in plugin/theme editor, enforcing least-privilege administrator access, and monitoring for unexpected plugin/theme file changes. If exploitation is suspected, rotate WordPress salts, database credentials, administrator passwords, API keys, WooCommerce integration credentials, and any secrets stored on the affected host after the site has been cleaned.

How to confirm the fix worked

Confirm the installed HUSKY plugin version is greater than 1.3.6.5 or that the plugin is fully removed/disabled. Validate through the WordPress admin plugin page, the plugin metadata files under wp-content/plugins, and centralized software inventory where available. Test that unauthenticated requests to wp-admin/admin-ajax.php using action=woof_text_search cannot cause arbitrary template inclusion and return only expected application responses. Review web server configuration to ensure PHP execution is blocked in wp-content/uploads and other user-writable directories. After patching, rescan externally to confirm the vulnerable endpoint behavior is no longer present and perform file integrity checks across wp-content/plugins, wp-content/themes, wp-content/uploads, cache directories, and WordPress core files.

Typical attack path

1. Scan the internet for WordPress sites using WooCommerce and the HUSKY Products Filter plugin.
2. Confirm the vulnerable AJAX action is reachable without authentication through wp-admin/admin-ajax.php.
3. Send crafted requests to the woof_text_search action with a manipulated template parameter referencing local paths.
4. Attempt to include readable files or PHP-interpretable files from plugin, theme, upload, cache, temporary, or log directories.
5. If code execution is achieved, run PHP commands in the context of the web server process.
6. Extract WordPress configuration secrets and database credentials.
7. Create persistence through a web shell, malicious plugin/theme modification, scheduled task, or unauthorized administrator account.
8. Access or alter WooCommerce data, customer records, product pages, checkout flows, or payment-related content.
9. Cover tracks by deleting uploaded payloads, rotating filenames, modifying timestamps, or clearing application logs.

How to detect it

Review web server access logs, WAF logs, CDN logs, WordPress security plugin logs, PHP error logs, and host filesystem telemetry for evidence of exploitation. Focus on unauthenticated POST or GET requests to /wp-admin/admin-ajax.php with action=woof_text_search and a template parameter containing path traversal, absolute file paths, WordPress configuration file references, upload-directory references, log-file references, stream wrappers, or suspicious encoded values. Correlate suspicious requests with 200 responses, 500 errors, unusual response sizes, or immediate follow-on requests to newly created PHP files under wp-content/uploads, wp-content/cache, plugin directories, or theme directories. On hosts, look for recently modified PHP files, files with image-like names but PHP content, obfuscated PHP functions, unexpected administrator account creation, modified plugin/theme files, suspicious cron jobs, and outbound network connections from the web server process. If logs show attempts to include wp-config.php, PHP session files, access logs, error logs, or uploaded files, assume credential exposure or code execution may have occurred until disproven.

• /wp-admin/admin-ajax.php
• action=woof_text_search
• template=
• action=woof_text_search&template=
• POST /wp-admin/admin-ajax.php
• GET /wp-admin/admin-ajax.php
• template=../
• template=..%2f
• template=%2e%2e%2f
• template=..%252f
• template=/etc/passwd
• template=../../../../wp-config.php
• template=wp-config.php
• template=php://filter
• template=php://input
• template=data://
• template=expect://
• template=/var/log/
• template=../../../../var/log/
• template=../../../../tmp/
• template=../../../../proc/self/environ
• wp-content/uploads/*.php
• wp-content/uploads/*.phtml
• wp-content/uploads/*.php5
• wp-content/cache/*.php
• wp-content/plugins/*/cache/*.php
• wp-content/themes/*/*.php
• eval(
• base64_decode(
• gzinflate(
• str_rot13(
• shell_exec(
• system(
• passthru(
• assert($_
• preg_replace('/.*/e'

What your security team should do

• Immediately inventory internet-facing WordPress sites for the HUSKY – Products Filter Professional for WooCommerce plugin and prioritize any version up to and including 1.3.6.5.
• Patch to a fixed version newer than 1.3.6.5 or remove the plugin if no fixed version is available.
• Because exploit maturity is weaponized and EPSS is high, treat vulnerable public sites as likely targeted and perform compromise assessment rather than patch-only closure.
• Search HTTP access logs for unauthenticated admin-ajax.php requests containing action=woof_text_search and suspicious template parameter values.
• Inspect wp-content/uploads, plugin directories, theme directories, cache directories, and temporary directories for unexpected PHP files, recently modified files, obfuscated code, or web shells.
• Disable PHP execution in upload and cache directories and enforce restrictive filesystem permissions for the web server user.
• Review WordPress users for newly created or modified administrator accounts and revoke unknown sessions or application passwords.
• Rotate database credentials, WordPress authentication salts, administrator passwords, and WooCommerce/API integration secrets if evidence of exploitation is found.
• Deploy WAF detections for path traversal and local file inclusion attempts against admin-ajax.php, especially requests containing template=, action=woof_text_search, directory traversal sequences, or references to wp-config.php, uploads, logs, or temporary paths.
• Preserve relevant web, PHP, WordPress, WAF, and filesystem evidence before cleanup to support incident scoping.