CVE-2026-9662

The flaw

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter befor

What to do

Review advisory and patch per vendor guidance.

References