VulnSocial

CVE-2026-92969Patch

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-98

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-09-23); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-09-23: 3Mentions · 2026-09-29: 1Patch / Workaround · 2026-09-23: 3Technical Details · 2026-09-23: 3Technical Details · 2026-09-29: 109-2309-29
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-233
Patch3
2026-09-291
Disclosure1
Full discourse4 posts
  • MLAUNCHER@MLUNCHER
    Patch

    🚨 آسیب‌پذیری جدید WordPress CVE-2026-92969 در افزونه HUSKY تا نسخه 1.4.4: بدون نیاز به لاگین → LFI نسخه امن: 1.4.5+ اگه WordPress داری، همین الان افزونه‌هات رو چک کن 🔥 پ.ن: ماشالا به امنیت وردپرس #WordPress #CyberSecurity #CVE

    Post summary

    The tweet announces CVE-2026-92969, a local file inclusion (LFI) vulnerability in the HUSKY WordPress plugin affecting versions up to 1.4.4, and explicitly directs users to update to version 1.4.5+ as the patched release.

    1000074
    11 followersView on X
  • LoreleiWeb@LoreleiWeb
    Patch

    🆕👉 HUSKY https://wpdeeply.com/husky-1-4-4-unauthenticated-local-file-inclusion-cve-2026-92969/ #loreleiweb HUSKY – Products Filter for WooCommerce Professional 1.4.4 and earlier is affected by an unauthenticated local file inclusion flaw, CVE-2026-92969. The plugin has more than 80,000 active installations. Update to 1.4.5 or later no… https://t.co/B2LGQYuzBs

    Post summary

    The text announces CVE-2026-92969, an unauthenticated local file inclusion vulnerability in HUSKY Products Filter for WooCommerce, and emphasizes the need to update to version 1.4.5 or later for remediation.

    00010216
    85.8K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-92969: HUSKY WooCommerce plugin LFI, CVSS 8.1, unpatched. Unauth attackers can execute PHP and grab sensitive data. No fix yet, so disable the plugin now. https://www.valtersit.com/cve/CVE-2026-92969 #CVE #infosec #WordPress #HUSKY #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-92969, a LFI vulnerability in the HUSKY WooCommerce plugin with CVSS 8.1, noting it is unpatched and urging plugin disablement, but provides no evidence of active exploitation, named exploit tools, or available patches.

    0000032
    1.1K followersView on X
  • MLAUNCHER@MLUNCHER
    Patch

    جزئیات جالب‌ترش اینه که CVE-2026-92969 از نوع LFI ـه و بدون احراز هویت قابل تریگر شدنه نسخه‌های HUSKY تا "1.4.4" تحت‌تأثیرن و "1.4.5" این مشکل رو رفع می‌کنه اگه از این افزونه استفاده می‌کنید، آپدیتش رو جدی بگیرید

    Post summary

    The text describes CVE-2026-92969 as an unauthenticated LFI affecting HUSKY versions up to 1.4.4, fixed in version 1.4.5, and urges users to apply the update.

    0000055
    11 followersView on X

Explore more

Back to dashboard