CVE-2025-1661

Published Mar 11, 2025

Last updated a month ago

WordPress

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-1661 is a local file inclusion (LFI) vulnerability affecting the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, specifically versions up to and including 1.3.6.5. The vulnerability lies within the 'template' parameter of the `woof_text_search` AJAX action. This allows unauthenticated attackers to potentially include and execute arbitrary files on the server, which could enable them to execute PHP code within those files. Exploitation of this vulnerability could allow attackers to bypass access controls, access sensitive data, and potentially achieve remote code execution, particularly if the server allows uploads of image or other seemingly harmless file types that could contain embedded malicious code. As of March 11, 2025, there is no publicly available proof-of-concept exploit, nor is there evidence of active exploitation. However, technical details about the vulnerability are known.

Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Source: security@wordfence.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:pluginus:husky_-_products_filter_professional_for_woocommerce:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E0D61F93-67D0-42D0-86C1-2FBF35CA2385",
            "versionEndExcluding": "1.3.6.6"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]