CVE-2026-9662: Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter

Synopsis

Local File Inclusion in the Recover Exit For WooCommerce WordPress plugin (versions up to and including 1.0.3) allows an unauthenticated remote attacker to manipulate the `tpf` POST parameter to traverse the file system and include arbitrary local PHP files. The vulnerability is reachable over the network with no credentials required, though exploitation demands some environmental setup. Successful exploitation exposes sensitive information and, in deployments where an attacker can stage a suitable file, enables remote code execution. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable `recover_exit()` function is reachable over the network via a crafted HTTP POST request, so the attacker must be able to reach the WordPress installation from the internet or an adjacent network.

• AuthenticationNot required

  No account or session token is required; the `tpf` parameter is accepted from completely unauthenticated POST requests.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator of the target site.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning reliable exploitation depends on environmental factors such as the presence of a PHP-interpretable file the attacker can include; a naive path-traversal payload alone may not be sufficient without additional staging steps.

Blast Radius

• An attacker reads local PHP files, including WordPress configuration files such as `wp-config.php`, exposing database credentials, authentication keys, and salts.
• With database credentials in hand, an attacker queries or modifies stored WooCommerce order records, customer personally identifiable information, and payment metadata.
• In deployments where the attacker can first write a PHP-executable file to disk (for example, via an upload endpoint or server-side log poisoning), file inclusion escalates to arbitrary code execution on the web server process.
• Full compromise of confidentiality, integrity, and availability of the affected WordPress installation is achievable in those deployable-file scenarios, consistent with the CVSS C:H/I:H/A:H rating.