The Recover Exit For WooCommerce plugin includes a function that uses the POST parameter 'tpf' directly in a PHP include statement without validating the input. This omission permits an attacker to craft a path traversal payload that causes the server to read and execute arbitrary local PHP files. The vulnerability therefore allows an unauthenticated attacker to expose sensitive server files or inject malicious code, which could compromise confidentiality, integrity, or availability of the entire WordPress site.

Every WordPress site that uses the Recover Exit For WooCommerce plugin from plasmatizemedia, version 1.0.3 or earlier, is affected. Versions newer than 1.0.3 are not listed as vulnerable, so sites that have the plugin upgraded beyond that revision are spared.

The vulnerability scores an 8.1 on the CVSS vector, classifying it as high severity. No EPSS score is available, which indicates that the current exploitation probability is not quantified. The vulnerability is not listed in CISA's KEV catalog, but the lack of a KEV entry does not preclude attacker activity. Because the attack vector is unauthenticated local file inclusion, an adversary only needs to pose a crafted POST request to the plugin’s endpoint; no special credentials are required. If an attacker can read privileged files or place a malicious file in a location that the plugin may include, the impact can reach arbitrary code execution on the host, giving an attacker full control of the WordPress instance.