CVE-2025-1661

The vulnerability present in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is characterized by a Local File Inclusion (LFI) flaw. This issue arises from improper handling of the 'template' parameter within the woof_text_search AJAX action. When an attacker manipulates this parameter, they can potentially include arbitrary files from the server's file system. The exploitation of this vulnerability does not require authentication, which significantly lowers the barrier for attackers, as they can execute malicious PHP code embedded in the included files. This flaw affects all versions up to and including 1.3.6.5, making it a critical concern for any installations of this plugin.

Attack vectors for exploiting this vulnerability are straightforward yet highly effective. An unauthenticated attacker can craft a specific request to the vulnerable AJAX endpoint, altering the 'template' parameter to point to sensitive files on the server, such as configuration files or other PHP scripts. Once the attacker successfully includes a file, they can execute arbitrary PHP code, which may lead to full server compromise. For instance, if the attacker can upload a file containing malicious PHP code, they can then include and execute it, potentially allowing them to bypass access controls, manipulate data, or even gain administrative access to the WordPress installation.

The real-world impact of this vulnerability can be severe, particularly for e-commerce platforms relying on the WooCommerce plugin. Successful exploitation could lead to unauthorized access to sensitive customer data, including payment information, personal details, and order histories. The business risks associated with such a breach are substantial, encompassing financial losses, reputational damage, and potential legal repercussions due to non-compliance with data protection regulations. Furthermore, the ease with which this vulnerability can be exploited means that many businesses may find themselves targeted by opportunistic attackers seeking to exploit vulnerable systems.

To detect and mitigate this vulnerability, organizations should implement several strategies. Regularly updating the HUSKY plugin to the latest version is the most effective way to ensure that known vulnerabilities are patched. Additionally, employing a web application firewall (WAF) can help filter out malicious requests targeting the vulnerable AJAX endpoint. Monitoring server logs for unusual access patterns or attempts to include files can also provide early warning signs of an attempted exploitation. Furthermore, restricting file permissions on the server can minimize the potential impact of a successful attack by limiting the files that can be accessed or executed.

In conclusion, the Local File Inclusion vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin poses a significant threat to WordPress installations. Its ease of exploitation and potential for severe consequences necessitate immediate attention from website administrators. By adopting proactive detection and mitigation strategies, organizations can protect themselves from the risks associated with this vulnerability and maintain the integrity and security of their e-commerce platforms.

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2025-1661, evidenced by a recent emergence of new proof-of-concept exploits circulating within attacker communities. Our telemetry indicates a sustained upward trend in detection activity, accompanied by a modest increase in the EPSS score, signaling growing attacker interest and potential for exploitation. This development elevates the urgency for defenders, as the availability of multiple public PoCs lowers the barrier for adversaries to weaponize the vulnerability, increasing the likelihood of widespread exploitation attempts. Consequently, the threat level associated with this Local File Inclusion vulnerability has intensified, reflecting a more active exploitation landscape that demands heightened vigilance from security teams monitoring WordPress environments leveraging the affected plugin.

Update 2 — July 20, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the Local File Inclusion vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin. This increase in activity coincides with the emergence of additional proof-of-concept exploits publicly available on GitHub, which has lowered the technical barrier for adversaries to weaponize the flaw. Our telemetry indicates that this surge is not accompanied by a corresponding rise in the EPSS score, suggesting that while the exploitation attempts are becoming more frequent, the overall likelihood of widespread automated attacks remains stable for now. However, the growing exploitation activity signals heightened attacker interest and experimentation, which raises the risk of more sophisticated or large-scale campaigns developing imminently. For defenders, this evolving threat landscape underscores the need for increased monitoring and rapid response capabilities, as the vulnerability’s critical severity combined with active exploitation attempts significantly elevates the overall threat level.

Update 3 — August 05, 2026

CSURFACE threat intelligence has observed a marked escalation in exploitation attempts targeting the Local File Inclusion vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin. This increase is accompanied by the emergence of multiple new proof-of-concept exploits publicly available on GitHub, signaling growing attacker confidence and lowering the barrier for widespread exploitation. Although the EPSS score remains stable, the sustained rise in detection activity across our sensors indicates that adversaries are actively refining their tactics and expanding testing efforts. This development elevates the threat level by increasing the likelihood of successful attacks, particularly against unpatched or poorly monitored WordPress environments. Defenders should recognize that the vulnerability is no longer a theoretical risk but an actively exploited vector, underscoring the urgency of enhanced detection and response measures.