CVE-2026-92969 describes a Local File Inclusion vulnerability in the HUSKY – Products Filter for WooCommerce Professional plugin for WordPress, affecting all versions up to and including 1.4.4. The flaw exists in the handling of the 'shortcode' parameter, which can be manipulated by unauthenticated attackers to include arbitrary PHP files on the server. The plugin's access control relies on a nonce (woof_front_nonce) that is publicly available in inline JavaScript on all front-end pages, effectively allowing any visitor to bypass authentication. This can lead to remote code execution, data disclosure, and access control bypass.

An attacker can execute arbitrary PHP code on the affected server by including malicious files, potentially leading to full compromise of the web server, unauthorized data access, and bypassing of security controls. The vulnerability is exploitable without authentication due to the publicly exposed nonce, increasing the risk and ease of exploitation.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider disabling or removing the plugin to prevent exploitation. Additionally, restrict file upload capabilities and harden server configurations to limit the impact of potential file inclusion attacks.