CVE-2025-52708: HUSKY WooCommerce Filter LFI Vulnerability

CVE-2025-52708 Overview

CVE-2025-52708 is a PHP Local File Inclusion (LFI) vulnerability affecting the RealMag777 HUSKY WooCommerce Products Filter WordPress plugin. The flaw results from improper control of filenames passed to PHP include or require statements, classified under [CWE-98]. Authenticated attackers can manipulate file path parameters to load arbitrary local PHP files within the server context. The vulnerability impacts all versions of HUSKY up to and including 1.3.7. Successful exploitation enables code execution, sensitive file disclosure, and integrity compromise of WooCommerce-backed storefronts.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to code execution and disclosure of sensitive configuration files such as wp-config.php.

Affected Products

RealMag777 HUSKY (woocommerce-products-filter) plugin versions through 1.3.7
WordPress sites running WooCommerce with the HUSKY filter plugin installed
Hosting environments exposing the plugin endpoints to authenticated users

Discovery Timeline

2025-06-20 - CVE-2025-52708 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-52708

Vulnerability Analysis

The HUSKY plugin passes user-controllable input into a PHP file inclusion routine without sufficient sanitization or allowlist validation. An attacker with low-level authenticated access can supply a crafted path that resolves to an arbitrary file on the local filesystem. When PHP processes the inclusion, the targeted file executes within the WordPress runtime context.

This behavior matches the [CWE-98] pattern: Improper Control of Filename for Include/Require Statement in PHP Program. Although the official advisory labels the issue PHP Remote File Inclusion, exploitation is limited to local file inclusion because allow_url_include is typically disabled in modern PHP deployments. The affected plugin scope spans all releases up to and including version 1.3.7.

Root Cause

The root cause is the use of attacker-influenced input in an include or require statement without restricting the value to a fixed set of safe template files. The plugin lacks both canonicalization checks and an allowlist of permitted include targets, allowing path traversal sequences and absolute paths to reach the inclusion call.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An authenticated attacker submits a request to a vulnerable HUSKY endpoint with a manipulated parameter referencing a local file. The PHP interpreter loads and executes the referenced file, exposing its contents or running its code with the privileges of the web server process.

Refer to the Patchstack WordPress Vulnerability advisory for technical details on the affected parameter and request flow.

Detection Methods for CVE-2025-52708

Indicators of Compromise

Web access logs containing path traversal sequences such as ../, ..%2f, or absolute filesystem paths in HUSKY plugin request parameters
Unexpected reads of sensitive files including wp-config.php, /etc/passwd, or PHP session files originating from the web server user
New or modified PHP files in wp-content/uploads/ that are subsequently referenced by HUSKY plugin requests
Outbound connections from the web server to unfamiliar hosts shortly after suspicious plugin requests

Detection Strategies

Inspect HTTP request parameters delivered to HUSKY plugin endpoints for filesystem path patterns and null byte injection attempts
Correlate authenticated WordPress sessions with anomalous file read operations on the PHP-FPM or Apache worker process
Apply WordPress security scanners or file integrity monitoring to detect modifications to plugin and core files

Monitoring Recommendations

Forward Apache, Nginx, and PHP error logs to a centralized log platform and alert on inclusion-related warnings such as failed to open stream
Monitor for include() and require() execution paths referencing locations outside the plugin directory
Track creation of new administrative WordPress users or scheduled tasks following suspicious plugin activity

How to Mitigate CVE-2025-52708

Immediate Actions Required

Upgrade the HUSKY WooCommerce Products Filter plugin to a version later than 1.3.7 as soon as the vendor publishes a fix
Restrict access to the WordPress admin and authenticated user roles that can reach HUSKY plugin endpoints
Audit web server and PHP logs for prior exploitation attempts referencing local file paths
Rotate WordPress secret keys, database credentials, and API tokens if wp-config.php exposure is suspected

Patch Information

Review the Patchstack advisory for the HUSKY plugin for the latest fixed version information. Apply the patched release through the WordPress plugin updater or by deploying the updated package from the vendor.

Workarounds

Deploy a web application firewall rule that blocks path traversal sequences and absolute paths in HUSKY plugin parameters
Disable the HUSKY plugin until a patched version is installed if the storefront can tolerate the loss of filtering functionality
Set open_basedir in PHP to confine file access to the WordPress document root and required directories
Ensure allow_url_include and allow_url_fopen are disabled in php.ini to prevent escalation to remote file inclusion

bash

# Example php.ini hardening to reduce LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"