The HUSKY WordPress plugin versions prior to 1.4.1 suffer from an improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the plugin does not sanitize a stored setting value before concatenating it into a file inclusion path. This enables users with the shop manager capability to perform directory traversal attacks, causing arbitrary local files to be included and executed. The vulnerability is triggered on every front-end request, including those from unauthenticated visitors, potentially amplifying the impact.

Exploitation allows a user with shop manager privileges to include and execute arbitrary local files on the server. Because the malicious inclusion is triggered on every front-end request, even unauthenticated visitors can indirectly cause execution of these files. This can lead to unauthorized code execution, data disclosure, or other impacts depending on the included files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager privileges to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable plugin in production environments if possible.