CVE-2026-9662 is a Local File Inclusion vulnerability in the Recover Exit For WooCommerce plugin for WordPress, affecting all versions up to and including 1.0.3. The issue stems from improper control of the filename used in an include() statement within the recover_exit() function, where the 'tpf' POST parameter is not sufficiently validated or sanitized. This allows unauthenticated attackers to perform path traversal attacks to include arbitrary local PHP files. The vulnerability can lead to sensitive information disclosure and, depending on the deployment context, remote code execution. The CVSS v3.1 base score is 8.1, indicating high severity. There is no vendor advisory or patch currently available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to include arbitrary local files on the server via path traversal in the 'tpf' parameter. This can result in disclosure of sensitive information and potentially remote code execution depending on the server configuration and included files. The vulnerability affects confidentiality, integrity, and availability as reflected in the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Recover Exit For WooCommerce plugin or restricting access to the vulnerable functionality. Avoid exposing the vulnerable endpoint to untrusted users. Monitor vendor channels for updates and apply patches promptly once available.