Atomic Edge analysis of CVE-2026-9662 (metadata-based): An unauthenticated Local File Inclusion vulnerability exists in the Recover Exit For WooCommerce plugin for WordPress, up to and including version 1.0.3. The flaw resides in the `recover_exit()` function, where the user-supplied `tpf` POST parameter is used directly in an `include()` statement without sufficient validation or sanitization. This allows remote attackers with no authentication to include arbitrary local PHP files, leading to information disclosure and potential code execution. The CVSS score of 8.1 (High) reflects the critical impact, although exploitation requires high attack complexity (AC:H), likely due to the need for specific file presence or server configuration.
The root cause, inferred from the CWE-98 classification and the CVE description, is a classic PHP file inclusion vulnerability arising from the `include()` function being called with a user-controlled path. The `tpf` POST parameter is passed to `include()` after only minimal or no sanitization, and no path traversal checks exist. This allows an attacker to use `../` sequences to navigate the filesystem and include arbitrary PHP files. The lack of code or plugin availability means we confirm the general pattern from the description, but specific implementation details (like whether the path is relative to a plugin directory) are inferred from typical WordPress plugin patterns.
Exploitation occurs by sending a POST request to the WordPress AJAX handler (`/wp-admin/admin-ajax.php`) with the `action` parameter set to the plugin’s registered hook (likely `recover_exit` or similar derived from the function name). The attacker includes the `tpf` parameter with a path traversal payload, such as `../../../etc/passwd` for file disclosure, or a path to a PHP web shell for code execution. Because no nonce or capability check is required (unauthenticated), the attack is straightforward. Multiple requests can enumerate files or trigger inclusion of a malicious file uploaded via another vector.
Remediation requires the plugin developers to properly validate and sanitize the `tpf` parameter before inclusion. The fix should involve preventing path traversal by stripping `../` sequences and restricting the include path to an allowed directory (e.g., using `realpath()` for canonicalization). Alternatively, using a whitelist of allowed files or avoiding `include()` with user input entirely would eliminate the vulnerability. Until a patch is released, users must disable the plugin or apply a virtual patch via a WAF.
The impact is severe: an unauthenticated attacker can read arbitrary files on the server (leading to sensitive data exposure, including WordPress configuration files containing database credentials). In scenarios where the server allows file uploads (e.g., via other plugins or WordPress media upload), the attacker can include a malicious PHP file to achieve remote code execution, complete server compromise, and further lateral movement.
