What is the CVSS score of CVE-2026-9662?

CVE-2026-9662 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Recover Exit For WooCommerce CVE-2026-9662

EUVD-2026-35301 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-09 Wordfence

GHSA-m9vh-97x5-pc68

Information Disclosure WordPress Path Traversal PHP RCE LFI Recover Exit For Woocommerce

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 8.1

Analysis Generated

Jun 09, 2026 - 05:05 vuln.today

DescriptionCVE.org

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled tpf POST parameter before it is used in an include() path in the recover_exit() function. This makes it possible for unauthenticated attackers to perform path traversal and include unintended local PHP files, which can lead to sensitive information exposure and, in certain deployment chains, code execution.

AnalysisAI

Local File Inclusion in the Recover Exit For WooCommerce WordPress plugin (versions up to and including 1.0.3) allows remote unauthenticated attackers to include arbitrary local PHP files via the unsanitized tpf POST parameter passed to include() in the recover_exit() function. Successful exploitation can disclose sensitive files such as wp-config.php and, when combined with file upload primitives or log poisoning, escalate to remote code execution. No public exploit identified at time of analysis, though the vulnerable sink is documented in the plugin source on plugins.trac.wordpress.org.

Technical ContextAI

The flaw is a classic PHP File Inclusion (CWE-98) where untrusted input from $_POST['tpf'] is concatenated into a PHP include() call inside recover_exit_main.php (lines 41-42) without path normalization, allow-listing, or extension enforcement. Because PHP include() evaluates any included file as PHP code, traversal sequences (e.g. ../../../../) or php:// / phar:// wrappers can be abused depending on PHP configuration (allow_url_include, stream wrapper availability). The CPE cpe:2.3:a:plasmatizemedia:recover_exit_for_woocommerce confirms the vendor is Plasmatize Media and the affected component is a WooCommerce companion plugin that hooks into WordPress's request lifecycle, making the vulnerable endpoint reachable on any WordPress site running the plugin.

RemediationAI

No vendor-released patch identified at time of analysis - version 1.0.3 remains the latest published release on the WordPress plugin repository per the provided references. Administrators should deactivate and uninstall the Recover Exit For WooCommerce plugin immediately and, until a fixed version ships, replace its abandoned-cart recovery functionality with a maintained alternative; the side effect is loss of any recover-exit campaigns currently configured. As a compensating control, web application firewall rules (Wordfence ships protections by default) should block POST requests containing traversal sequences or php:///phar:// wrappers in the tpf parameter to any endpoint loading recover_exit_main.php, and open_basedir plus allow_url_include=Off should be enforced in PHP to limit file inclusion scope. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/10552714-c8fb-455c-ad61-c0ef2db4b69f) for the patched version once released.