CVE-2026-15244 Overview
CVE-2026-15244 affects the HUSKY WordPress plugin in versions prior to 1.4.1. The plugin fails to sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path. Users with the shop manager capability can abuse this flaw to include and execute arbitrary local files. The malicious payload persists in plugin settings and triggers on every front-end request, including requests from unauthenticated visitors. This behavior classifies the issue as Local File Inclusion (LFI) through Path Traversal [CWE-22].
Critical Impact
An authenticated shop manager can plant a traversal payload that executes arbitrary local PHP files for every visitor to the site, resulting in server compromise and full site takeover.
Affected Products
- HUSKY WordPress plugin (Products Filter Professional for WooCommerce) versions before 1.4.1
- WordPress sites running WooCommerce with the vulnerable plugin installed
- Any front-end visitor session on affected installations
Discovery Timeline
- 2026-08-01 - CVE-2026-15244 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-15244
Vulnerability Analysis
The HUSKY plugin persists a configuration value that the code later concatenates into a include/require file path. Because the plugin does not filter directory traversal sequences such as ../, an attacker holding the shop manager WooCommerce role can save a crafted value that redirects the inclusion to any local file readable by the web server. The plugin loads this path on every front-end request, so the injected file is parsed by PHP whenever any visitor, authenticated or not, hits the site.
The attack combines two properties. First, the payload is stored, giving the attacker persistence. Second, the trigger runs in the front-end bootstrap, giving the payload universal reach across the site.
Root Cause
The root cause is missing input sanitization on a stored setting used in a file inclusion sink. The plugin trusts the setting value and passes it into a PHP file inclusion function without validating that the resolved path stays within an expected directory. This is a textbook Path Traversal to Local File Inclusion pattern tracked as [CWE-22].
Attack Vector
Exploitation requires an account with the WooCommerce shop manager capability. The attacker updates the vulnerable HUSKY setting through the plugin's administrative interface, embedding traversal characters that redirect the inclusion path. Once stored, no further attacker interaction is needed. The next front-end page load, from any visitor, executes whatever local file the traversal resolves to. Attackers commonly chain this with a prior file upload primitive or with log poisoning to reach code execution. See the WPScan Vulnerability Information entry for further technical detail.
Detection Methods for CVE-2026-15244
Indicators of Compromise
- Modifications to HUSKY plugin settings in the wp_options table containing ../ or absolute path sequences
- Unexpected PHP include/require warnings in web server error logs referencing paths outside the plugin directory
- Front-end requests producing anomalous PHP execution from files under /tmp, /var/log, or upload directories
- New administrator accounts, modified wp-config.php, or webshell files appearing after a shop manager login
Detection Strategies
- Inventory WordPress sites and flag installations running HUSKY versions earlier than 1.4.1
- Audit wp_options and plugin configuration tables for setting values containing directory traversal characters
- Correlate shop manager login events with subsequent plugin setting changes in WordPress audit logs
- Alert on PHP file inclusions that resolve outside the WordPress installation root
Monitoring Recommendations
- Enable a WordPress activity log plugin to capture setting changes and role assignments
- Forward web server, PHP-FPM, and WordPress logs to a centralized SIEM for cross-correlation
- Monitor outbound network connections from the web server that may indicate post-exploitation callbacks
- Track file integrity on wp-content/, wp-config.php, and the document root to catch webshell drops
How to Mitigate CVE-2026-15244
Immediate Actions Required
- Update the HUSKY plugin to version 1.4.1 or later on all affected WordPress installations
- Review all accounts holding the shop manager role and remove unused or over-privileged users
- Rotate credentials for any account that had shop manager access before the patch was applied
- Inspect plugin settings for traversal payloads and revert any suspicious values
Patch Information
The vendor addressed the issue in HUSKY version 1.4.1 by sanitizing the stored setting before it is concatenated into the file inclusion path. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Confirm the installed version reports 1.4.1 or higher after the update.
Workarounds
- Temporarily deactivate the HUSKY plugin until the patched version can be installed
- Restrict the shop manager role to trusted staff and require multi-factor authentication for those accounts
- Deploy a web application firewall rule that blocks traversal sequences in HUSKY plugin admin requests
- Use PHP open_basedir restrictions to confine file inclusion to the WordPress document root
# Configuration example: enforce open_basedir in php.ini for the WordPress vhost
open_basedir = "/var/www/wordpress/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
# Verify installed HUSKY version via WP-CLI
wp plugin get woocommerce-products-filter --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
