# CVE-2025-1661: HUSKY – Products Filter Professional for WooCommerce - Path Traversal

> Live exploitation tracking for CVE-2025-1661 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-1661

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Realmag777 HUSKY – Products Filter Professional for WooCommerce
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** wordpress, ecommerce, cms

## Description

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

## CrowdSec analysis

[CVE-2025-1661](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-1661) is a critical vulnerability in the HUSKY – Products Filter Professional for WooCommerce WordPress plugin that allows unauthenticated attackers to exploit a Local File Inclusion flaw via the 'template' parameter. This vulnerability enables remote attackers to include and execute arbitrary files on the server, potentially leading to full remote code execution, data theft, or bypassing access controls. Attackers could leverage this flaw to upload and execute malicious PHP code, posing a severe risk to affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.

CrowdSec network data shows that most actors exploiting CVE-2025-1661 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-1661 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-1661 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit the unauthenticated AJAX endpoint `/wp-admin/admin-ajax.php` by abusing the `template` parameter in requests with `action=woof_text_search` to perform local file inclusion, often targeting sensitive files such as `wp-config`.

## Timeline

- 2025-03-11: CVE Published. CVE-2025-1661 is published to NVD.
- 2026-04-15: Rule Released. CrowdSec releases a rule to detect CVE-2025-1661 exploitation attempts against the CrowdSec Network.
- 2026-04-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-1661 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1661.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-1661) follows observed exploitation activity for CVE-2025-1661. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.