The HUSKY – Products Filter Professional for WooCommerce plugin suffers from a Local File Inclusion vulnerability (CWE-22) due to improper limitation of a pathname to a restricted directory. Specifically, the 'template' parameter in the woof_text_search AJAX action can be manipulated by unauthenticated attackers to include arbitrary files. This flaw allows execution of any PHP code contained in those files, which can lead to complete compromise of the affected server environment. The vulnerability affects all versions up to and including 1.3.6.5. The CVSS v3.1 base score is 9.8, reflecting its critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. There are no known exploits in the wild at the time of publication, and no patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the server, bypass access controls, and access sensitive data. This can lead to full system compromise, data theft, and disruption of service. The vulnerability is critical with a CVSS score of 9.8, indicating a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable AJAX action if possible, disable the plugin if not essential, or implement web application firewall rules to block malicious requests targeting the 'template' parameter. Monitor vendor channels for updates and apply patches promptly once released.