CVE-2025-1661
CRITICAL EXPLOITED NUCLEIHUSKY Products Filter Professional for WooCommerce <= 1.3.6.5 - Local File Inclusion via 'template'
Title source: llmExploitation Summary
CVE-2025-1661 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including iSee857, gbrsh, shahwarshah. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2026-22812, demonstrating remote command execution (RCE) in OpenCode. The script sends a crafted JSON payload to the target's session endpoint, then executes commands via the shell endpoint, verifying success by checking for 'uid=' and 'gid=' in the response.
Description
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Exploits (4)
The repository contains a functional exploit for CVE-2026-22812, demonstrating remote command execution (RCE) in OpenCode. The script sends a crafted JSON payload to the target's session endpoint, then executes commands via the shell endpoint, verifying success by checking for 'uid=' and 'gid=' in the response.
This is a functional exploit for CVE-2025-1661, targeting a Local File Inclusion (LFI) vulnerability in HUSKY – Products Filter Professional for WooCommerce. The exploit can escalate to Remote Code Execution (RCE) via log poisoning.
This repository contains a detailed writeup and proof-of-concept for CVE-2025-1661, an unauthenticated Local File Inclusion (LFI) vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. The vulnerability allows attackers to include and execute arbitrary files on the server via the `template` parameter of the `woof_text_search` AJAX action.
This repository contains a proof-of-concept for an unauthenticated Local File Inclusion (LFI) vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin. The exploit leverages the `template` parameter in the `woof_text_search` AJAX action to read arbitrary files from the server.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H