CVE-2024-32680: HUSKY WooCommerce Filter Path Traversal

CVE-2024-32680 Overview

CVE-2024-32680 is a path traversal and code injection vulnerability in the HUSKY – Products Filter for WooCommerce (formerly WOOF) WordPress plugin developed by PluginUS. The flaw affects all versions up to and including 1.3.5.2. Authenticated attackers with low privileges can exploit the plugin to include malicious files and execute arbitrary code on the WordPress host. The issue is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and results in remote code execution against affected WooCommerce storefronts.

Critical Impact
Authenticated attackers can achieve remote code execution on WordPress sites running vulnerable versions of the HUSKY Products Filter plugin, leading to full site compromise.

Affected Products

PluginUS HUSKY – Products Filter Professional for WooCommerce (formerly WOOF)
All versions from n/a through 1.3.5.2
WordPress installations running the vulnerable plugin

Discovery Timeline

2024-05-17 - CVE-2024-32680 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32680

Vulnerability Analysis

The HUSKY Products Filter plugin fails to properly validate file path inputs and control code generation when handling requests. This combination allows an authenticated user to escape the plugin's intended directory and load arbitrary files from the server. When the loaded file contains PHP code, the plugin executes it in the WordPress process context.

The vulnerability chains path traversal with code injection. An attacker first supplies a crafted file path that traverses outside the plugin's expected working directory using sequences such as ../. The plugin then dynamically includes or evaluates the referenced content, resulting in code execution under the web server user. Successful exploitation grants full control over the WordPress installation, including database access, theme and plugin files, and any secrets stored on disk.

Root Cause

The root cause is missing input sanitization on parameters that reference file paths, combined with unsafe use of PHP file inclusion or evaluation constructs. The plugin does not restrict paths to a whitelist or validate that included files reside within a trusted directory. This design flaw enables arbitrary local file inclusion that escalates to code execution when attacker-controlled content is reachable.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface. The attacker requires low-privilege authentication on the target site. No user interaction is needed beyond the attacker's own request. Once authenticated, the attacker issues a crafted request to the vulnerable plugin endpoint, referencing a traversal path that resolves to attacker-controlled or attacker-influenced content such as uploaded media, log files, or session data containing PHP payloads.

Technical details are available in the Patchstack RCE Vulnerability Advisory.

Detection Methods for CVE-2024-32680

Indicators of Compromise

HTTP requests to HUSKY plugin endpoints containing ../ sequences or absolute file paths in parameters
Unexpected PHP processes spawned by the web server user shortly after authenticated requests to /wp-admin/admin-ajax.php targeting HUSKY actions
New or modified PHP files in wp-content/uploads/ or the plugin directory with recent timestamps
Outbound network connections initiated by the PHP-FPM or Apache worker processes to unknown hosts

Detection Strategies

Inspect web server access logs for HUSKY plugin AJAX actions containing path traversal patterns in query strings or POST bodies
Compare file hashes in the woocommerce-products-filter plugin directory against known-good releases to identify tampering
Monitor WordPress audit logs for low-privilege accounts issuing requests to filter-related endpoints outside normal usage patterns

Monitoring Recommendations

Enable WordPress activity logging for authenticated user actions targeting plugin AJAX endpoints
Configure a web application firewall to flag traversal sequences and null-byte encodings in HTTP parameters
Alert on PHP file creation events inside wp-content/uploads/ and other writable directories

How to Mitigate CVE-2024-32680

Immediate Actions Required

Update the HUSKY – Products Filter for WooCommerce plugin to a version later than 1.3.5.2 as soon as the vendor patch is available
Audit WordPress user accounts and revoke unnecessary low-privilege access that could be used to authenticate against the vulnerable endpoint
Review the plugin directory and WordPress uploads folder for unauthorized PHP files

Patch Information

Refer to the Patchstack RCE Vulnerability Advisory for patch availability. Administrators should upgrade to the fixed release provided by PluginUS through the WordPress plugin repository once published.

Workarounds

Deactivate and remove the HUSKY Products Filter plugin until a patched version is installed
Deploy web application firewall rules that block path traversal sequences and restrict access to the plugin's AJAX handlers
Disable PHP execution in the wp-content/uploads/ directory using web server configuration to reduce the impact of file inclusion attempts
Restrict WordPress account creation and enforce strong authentication to limit the pool of users capable of exploiting the vulnerability

bash

# Example: disable PHP execution in wp-content/uploads (Apache)
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.ph(p[3457]?|t|tml)$">
        Require all denied
    </FilesMatch>
</Directory>