CVE-2025-15662: Printcart Web to Print Product Designer SSRF and file disclosure

CVE-2025-15662 · Severity: info · CVSS 8.6 · Published 2026-07-27

A vulnerability exists in the Printcart Web to Print Product Designer plugin for WordPress, which is used to allow customers to design custom products on e-commerce sites. An attacker can exploit this flaw to bypass security checks and view sensitive files on the web server, such as database passwords and secret configuration keys. Additionally, attackers can use the server as a proxy to attack other internal systems that are not normally accessible from the internet.

Technologies: Printcart Web to Print Product Designer for WooCommerce. Vendors: Printcart.

Quick answers

Is CVE-2025-15662 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-15662 being exploited in the wild.
How severe is CVE-2025-15662?
Informational severity, with a CVSS score of 8.6, published 27 July 2026.
Which products and versions are affected?
Printcart Web to Print Product Designer for WooCommerce < 2.5.3.
Is there a fix for CVE-2025-15662?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15662 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-15662?
Check whether you run Printcart Web to Print Product Designer for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `nbdesigner_copy_image_from_url` AJAX action, which fails to restrict user-supplied URLs and lacks proper authorization. An unauthenticated attacker can first obtain a required nonce via the `nbd_check_use_logged_in` handler and then submit a request using the `file://` wrapper or internal IP addresses. The plugin uses the `@copy()` function and `wp_remote_get()` (instead of `wp_safe_remote_get()`), allowing the retrieval of local files like `wp-config.php` or access to internal network resources. The fetched content is saved to a publicly accessible file with a server-generated name, which serves as the reflection channel for the attacker to read the data. This issue is fixed in version 2.5.3.

Affected products

  • Printcart Printcart Web to Print Product Designer for WooCommerce < 2.5.3

Timeline

  • 2025-12-04: disclosed: Initial discovery/reporting date
  • 2026-07-06: advisory: WPScan advisory published
  • 2026-07-27: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.