Is CVE-2026-9662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9662 being exploited in the wild.

How severe is CVE-2026-9662?

High severity, with a CVSS score of 8.1, published 9 June 2026.

Which products and versions are affected?

WooCommerce Recover Exit For WooCommerce up to and including 1.0.3.

Is there a fix for CVE-2026-9662?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9662 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9662?

Check whether you run WooCommerce Recover Exit For WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9662: WooCommerce Recover Exit local file inclusion in recover_exit

CVE-2026-9662 · Severity: high · CVSS 8.1 · Published 2026-06-09

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access internal system files. This plugin is typically used by e-commerce sites to retain customers who are about to leave the website. An attacker could exploit this to view sensitive configuration data or potentially take control of the website, leading to data theft or service disruption.

Vendors: WooCommerce.

Quick answers

Is CVE-2026-9662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9662 being exploited in the wild.
How severe is CVE-2026-9662?: High severity, with a CVSS score of 8.1, published 9 June 2026.
Which products and versions are affected?: WooCommerce Recover Exit For WooCommerce up to and including 1.0.3.
Is there a fix for CVE-2026-9662?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9662 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9662?: Check whether you run WooCommerce Recover Exit For WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Local File Inclusion (LFI) vulnerability exists in the Recover Exit For WooCommerce plugin due to insufficient validation and sanitization of the 'tpf' POST parameter. This parameter is used directly in an include() path within the recover_exit() function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to perform path traversal. Successful exploitation allows the attacker to include and execute local PHP files, which can result in the disclosure of sensitive information or full remote code execution depending on the server environment. All versions up to and including 1.0.3 are affected.

Affected products

WooCommerce Recover Exit For WooCommerce up to and including 1.0.3

Timeline

2026-06-09: disclosed
2026-06-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.