CVE-2026-15244: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in HUSKY
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
AI Analysis
Technical Summary
CVE-2026-15244 describes a path traversal vulnerability (CWE-22) in the HUSKY WordPress plugin versions prior to 1.4.1. The plugin fails to properly sanitize a stored setting value before concatenating it into a file inclusion path. This allows users with shop manager privileges to manipulate the path to include arbitrary local files, which are then executed on every front-end request, including those from unauthenticated users. This vulnerability has a CVSS 3.1 score of 7.2, indicating high severity with network attack vector, low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability.
Potential Impact
Successful exploitation enables an attacker with shop manager privileges to execute arbitrary local files on the server, potentially leading to full compromise of the WordPress site. Since the malicious inclusion is triggered on every front-end request, it can affect all visitors, including unauthenticated users, amplifying the impact. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Users should upgrade to version 1.4.1 or later once available, as the vulnerability affects versions before 1.4.1. Until a fix is released, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to file inclusion. Check the vendor advisory for updates on patch availability.
CVE-2026-15244: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in HUSKY
Description
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
CVSS v3.1
Score 7.2high
Affected software
HUSKY
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15244 describes a path traversal vulnerability (CWE-22) in the HUSKY WordPress plugin versions prior to 1.4.1. The plugin fails to properly sanitize a stored setting value before concatenating it into a file inclusion path. This allows users with shop manager privileges to manipulate the path to include arbitrary local files, which are then executed on every front-end request, including those from unauthenticated users. This vulnerability has a CVSS 3.1 score of 7.2, indicating high severity with network attack vector, low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability.
Potential Impact
Successful exploitation enables an attacker with shop manager privileges to execute arbitrary local files on the server, potentially leading to full compromise of the WordPress site. Since the malicious inclusion is triggered on every front-end request, it can affect all visitors, including unauthenticated users, amplifying the impact. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Users should upgrade to version 1.4.1 or later once available, as the vulnerability affects versions before 1.4.1. Until a fix is released, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to file inclusion. Check the vendor advisory for updates on patch availability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-09T11:57:28.549Z
- State
- PUBLISHED
Threat ID: 6a6d96d3bf32cb7a344cedd8
Added to database: 08/01/2026, 06:48:51 UTC
Last enriched: 08/08/2026, 13:53:01 UTC
Last updated: 09/15/2026, 10:01:30 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.