CVE-2025-26890

Executive Summary

CVE-2025-26890 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the HUSKY – WooCommerce Products Filter plugin (formerly known as WOOF) by RealMag777, for versions up to and including 1.3.6.4. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score of 7.5 reflects the high confidentiality impact and ease of exploitation over the network without authentication.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The HUSKY plugin is distributed via the official WordPress plugin repository and commercial marketplaces. Users who have installed the plugin from these sources are affected. There is no known supply chain compromise of the plugin itself, but the vulnerability introduces a significant risk to any WordPress site using the affected version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete compromise of the WordPress site's secrets.

Deep Dive & Mechanics

The vulnerability exists in the HUSKY plugin's handling of AJAX requests or shortcode parameters. The plugin likely uses a user-supplied parameter (e.g., template, file, or path) to dynamically include a PHP file for rendering. Due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../../) to escape the intended directory and include arbitrary files from the server.

Root Cause: The plugin uses a function like include($user_input . '.php') or similar, where $user_input is not validated against path traversal characters. This allows an attacker to specify an absolute path or a relative path with ../ to read sensitive files.

Example vulnerable code pattern:

$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );

An attacker could request ?template=../../../../etc/passwd to include /etc/passwd (though the .php extension might be appended, null byte injection or other techniques could bypass this).

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.6.4):

// In some AJAX handler or shortcode function
$file = $_REQUEST['file'];
include( WP_CONTENT_DIR . '/uploads/husky/' . $file );

No validation of $file allows path traversal.

Patched Code (Hypothetical):

$file = basename( $_REQUEST['file'] ); // Remove path components
$allowed_files = array( 'template1.php', 'template2.php' );
if ( in_array( $file, $allowed_files ) ) {
    include( WP_CONTENT_DIR . '/uploads/husky/' . $file );
} else {
    // Error handling
}

The patch would use basename() to strip directory traversal and whitelist allowed files.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with HUSKY plugin version <= 1.3.6.4.
• Knowledge of the vulnerable parameter (e.g., file, template, path).

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns: /wp-admin/admin-ajax.php?action=husky_load_template&file=... or a shortcode [husky file="..."].
2. Attempt to read /etc/passwd:

   GET /wp-admin/admin-ajax.php?action=husky_load_template&file=../../../../etc/passwd
   

3. If the .php extension is appended, try null byte injection (if PHP < 5.3.4) or use a wrapper like php://filter:

   GET /wp-admin/admin-ajax.php?action=husky_load_template&file=php://filter/convert.base64-encode/resource=../../../../etc/passwd
   

4. Read wp-config.php for database credentials:

   GET /wp-admin/admin-ajax.php?action=husky_load_template&file=../../../../wp-config
   

Lab Setup:

• Use Docker to spin up a vulnerable WordPress instance:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  # Install HUSKY plugin version 1.3.6.4 manually
  

• Use Burp Suite or curl to send crafted requests.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious ../ sequences in request parameters.
• Look for requests to admin-ajax.php with unusual action values like husky_load_template.
• Alert on attempts to read sensitive files (e.g., wp-config.php, /etc/passwd).

Hunting:

• Search for log entries containing file=.. or template=.. with path traversal patterns.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing ../ in parameters like file, template, or path.
  • Requests to /wp-admin/admin-ajax.php with action=husky_load_template or similar.
  • Response bodies containing base64-encoded data (from php://filter usage).
• File System:
  • Unexpected inclusion of files outside the plugin directory.
  • Presence of log entries with path traversal patterns.
• Logs:
  • Web server access logs with %2e%2e%2f (URL-encoded ../) or ..%2f.

Detection Engineering

YARA Rule

rule CVE_2025_26890_HUSKY_LFI {
    meta:
        description = "Detects path traversal attempts in HUSKY plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26890"
    strings:
        $path_traversal = /(file|template|path)=[^&]*\.\.\//
        $php_filter = /file=php:\/\/filter/
        $wp_config = /wp-config\.php/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-26890 HUSKY Plugin LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against HUSKY WooCommerce Products Filter plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'file=..'
            - 'template=..'
            - 'path=..'
            - 'php://filter'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26890 HUSKY LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=husky_load_template"; http_uri; pcre:"/(file|template|path)=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update to the latest version immediately.
2. Disable the plugin: If no patch is available, deactivate and delete the HUSKY plugin until a fix is released.
3. Web Application Firewall (WAF): Deploy WAF rules to block path traversal patterns (e.g., ../, ..\\, php://filter).

Long-term Fixes:

• The vendor should implement proper input validation using basename() and a whitelist of allowed files.
• Use realpath() to resolve the final path and ensure it stays within the intended directory.
• Avoid dynamic file inclusion based on user input entirely.

Detection:

• Enable detailed logging for all web requests.
• Monitor for the IOCs listed above.
• Use the provided YARA, Sigma, and Suricata rules in your SIEM/IDS.

Valters IT
Securing Digital Frontiers