Executive brief
The Recover Exit For WooCommerce plugin for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access internal system files. This plugin is typically used by e-commerce sites to retain customers who are about to leave the website. An attacker could exploit this to view sensitive configuration data or potentially take control of the website, leading to data theft or service disruption.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Recover Exit For WooCommerce plugin due to insufficient validation and sanitization of the 'tpf' POST parameter. This parameter is used directly in an include() path within the recover_exit() function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to perform path traversal. Successful exploitation allows the attacker to include and execute local PHP files, which can result in the disclosure of sensitive information or full remote code execution depending on the server environment. All versions up to and including 1.0.3 are affected.
Affected products
- WooCommerce Recover Exit For WooCommerce up to and including 1.0.3
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/tags/1.0.3/recover_exit_main.php
- https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/tags/1.0.3/recover_exit_main.php
- https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/tags/1.0.3/recoverexit_woocommerce.php
- https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/trunk/recover_exit_main.php
- https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/trunk/recover_exit_main.php
- https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/trunk/recoverexit_woocommerce.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/10552714-c8fb-455c-ad61-c0ef2db4b69f?source=cve