Printcart Store Web To Print Product Designer For Woocommerce
Monthly
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.