Executive brief
The Printcart Web to Print Product Designer for WooCommerce is a WordPress plugin that allows businesses to create custom print-on-demand products. An unauthenticated attacker can exploit a directory traversal flaw to read arbitrary files from the server, potentially exposing sensitive configuration files, database credentials, or customer data. The vulnerability requires no authentication due to a flawed security mechanism that issues valid access tokens to any visitor.
Technical details
The vulnerability is a directory traversal flaw in the 'mockups' parameter that allows attackers to navigate the file system and retrieve arbitrary files. The plugin fails to properly validate and sanitize the parameter, permitting path traversal sequences (e.g., ../../) to escape the intended directory. An unauthenticated attacker can obtain a valid nonce via the 'nbd_check_use_logged_in' AJAX endpoint, which returns a 'nbdesigner-get-data' nonce to any visitor without requiring authentication. If the NBDESIGNER_ENABLE_NONCE constant is disabled, the nonce requirement is bypassed entirely. The flaw is present in all versions up to and including 2.8.5, and patches are not yet confirmed as available.
Affected products
- Printcart Web to Print Product Designer for WooCommerce up to and including 2.8.5
Timeline
- 2026-09-18: disclosed