This vulnerability combines CWE-22 (Path Traversal) and CWE-94 (Code Injection) issues in the HUSKY – Products Filter for WooCommerce plugin, allowing attackers with low privileges to potentially include and execute malicious code by bypassing directory restrictions. The affected versions include all versions up to 1.3.5.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the publication date.

Successful exploitation could lead to full compromise of the affected WooCommerce plugin environment, including unauthorized code execution, data disclosure, and service disruption. The vulnerability impacts confidentiality, integrity, and availability with high severity. However, exploitation requires some level of privileges on the system, and no public exploits are currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit privileges of users who can interact with it. Monitor for updates from PluginUS regarding patches or official mitigations. Avoid deploying the affected versions in production environments if possible.