Executive brief
A vulnerability exists in the Printcart Web to Print Product Designer plugin for WordPress, which is used to allow customers to design custom products on e-commerce sites. An attacker can exploit this flaw to bypass security checks and view sensitive files on the web server, such as database passwords and secret configuration keys. Additionally, attackers can use the server as a proxy to attack other internal systems that are not normally accessible from the internet.
Technical details
The vulnerability exists in the `nbdesigner_copy_image_from_url` AJAX action, which fails to restrict user-supplied URLs and lacks proper authorization. An unauthenticated attacker can first obtain a required nonce via the `nbd_check_use_logged_in` handler and then submit a request using the `file://` wrapper or internal IP addresses. The plugin uses the `@copy()` function and `wp_remote_get()` (instead of `wp_safe_remote_get()`), allowing the retrieval of local files like `wp-config.php` or access to internal network resources. The fetched content is saved to a publicly accessible file with a server-generated name, which serves as the reflection channel for the attacker to read the data. This issue is fixed in version 2.5.3.
Affected products
- Printcart Printcart Web to Print Product Designer for WooCommerce < 2.5.3
Timeline
- 2025-12-04: disclosed: Initial discovery/reporting date
- 2026-07-06: advisory: WPScan advisory published
- 2026-07-27: advisory: NVD published date