CVE-2024-3061 in HUSKY Plugin
Summary
by MITRE • 03/29/2024
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-3061 affects the HUSKY – Products Filter Professional for WooCommerce plugin, a popular WordPress extension used for enhancing product filtering capabilities on e-commerce websites. This plugin operates within the WordPress ecosystem and provides administrative functionality for managing product categories and filtering options. The vulnerability exists in versions up to and including 1.3.5.2, making it a persistent threat across multiple releases of the plugin. The flaw specifically resides in how the plugin handles the 'type' parameter, which is processed without proper input validation or sanitization mechanisms, creating an exploitable condition that can be leveraged by malicious actors with administrative privileges.
The technical implementation of this vulnerability stems from improper parameter handling within the plugin's codebase, where user-supplied input from the 'type' parameter is directly used in file inclusion operations without adequate security checks. This represents a classic Local File Inclusion (LFI) vulnerability classified under CWE-98, which occurs when applications include files based on user-controllable input without proper validation. The vulnerability is particularly dangerous because it requires only authenticated access with administrator-level privileges, which many WordPress installations already have compromised through various attack vectors such as credential theft, phishing, or other exploitation techniques. Once an attacker gains administrative access, they can manipulate the 'type' parameter to include arbitrary files on the server, effectively bypassing normal access controls and executing PHP code with the privileges of the web server process.
The operational impact of this vulnerability extends far beyond simple code execution capabilities. Attackers can leverage this vulnerability to access sensitive system information, extract database credentials, modify or delete content, and potentially establish persistent backdoors within the WordPress installation. The vulnerability's exploitation potential is significantly amplified when combined with other attack vectors, particularly in environments where attackers can upload files such as images or other "safe" file types, as these can then be included through the LFI mechanism. This creates a multi-stage attack pattern where initial access might be gained through credential compromise, followed by privilege escalation using this LFI vulnerability to achieve full system compromise. The attack follows the ATT&CK framework's privilege escalation and persistence tactics, where the initial compromise allows for deeper system infiltration and control. Organizations running vulnerable versions of this plugin face significant risk of data breaches, service disruption, and potential regulatory compliance violations.
Mitigation strategies for CVE-2024-3061 require immediate action to address the root cause of the vulnerability. The primary recommendation is to upgrade to the latest version of the HUSKY – Products Filter Professional plugin where the LFI vulnerability has been patched and properly validated. Additionally, implementing proper input validation and sanitization for all user-controllable parameters should be enforced through secure coding practices, including the use of allowlists for acceptable file types and parameters. Network segmentation and access control measures should be implemented to limit administrative access to only trusted users and systems. Regular security audits and vulnerability scanning should be conducted to identify and remediate similar issues across the entire WordPress installation. The use of web application firewalls and security monitoring solutions can provide additional layers of protection by detecting and blocking suspicious parameter values. Organizations should also implement proper logging and monitoring of administrative activities to detect unauthorized access attempts or exploitation attempts, ensuring that any suspicious behavior is immediately flagged and investigated.