plasmatizemedia vulnerabilities and threats

The Recover Exit For WooCommerce WordPress plugin up to version 1.0.3 contains a Local File Inclusion vulnerability. This arises from insufficient validation of the user-controlled 'tpf' POST parameter used in an include() statement. Unauthenticated attackers can exploit this to perform path traversal and include unintended local PHP files, potentially exposing sensitive information and enabling code execution in some environments. The vulnerability is tracked as CVE-2026-9662 with a high severity score of 8.1. No official patch or remediation has been confirmed yet.