CVE-2026-9662 is a Local File Inclusion vulnerability in the Recover Exit For WooCommerce plugin for WordPress. The vulnerability arises from insufficient sanitization of the 'tpf' POST parameter used in an include() statement within the recover_exit() function. This flaw enables unauthenticated attackers to perform path traversal attacks to include arbitrary local PHP files, potentially exposing sensitive data or enabling code execution. The vulnerability affects all versions up to and including 1.0.3. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been published as of the provided data.

Exploitation of this vulnerability can lead to disclosure of sensitive information stored in local files and, in certain configurations, remote code execution. Because the vulnerability is exploitable without authentication, it poses a significant risk to affected WordPress sites using this plugin. The high CVSS score reflects the potential for complete compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Recover Exit For WooCommerce plugin to prevent exploitation. Additionally, restricting access to the affected endpoint and implementing web application firewall rules to block malicious POST requests targeting the 'tpf' parameter may reduce risk.