CVE-2026-14323

HighCVSS 7.5

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.94%

59th percentile - higher than 59% of all known CVEs

Summary

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.8.5 via the 'mockups' parameter. An unauthenticated attacker can read arbitrary files on the server, and the required nonce is easily obtainable by unauthenticated users.

Risk Assessment

An attacker can read configuration files, including database credentials and other secrets, potentially leading to full server compromise.

Recommendation

Update the Printcart Web to Print Product Designer plugin to a version later than 2.8.5 or disable it immediately if an update is not possible.

Other vulnerabilities in Printcart Web to Print Product Designer for WooCommerce

CVE-2026-9725Critical
The Printcart Web to Print Product Designer for WooCommerce plugin up to version 2.5.2 is vulnerable to arbitrary file deletion due to insufficient path validation in the store_design_data() function. The user-supplied 'nbd_item_key' POST parameter is sanitized only with sanitize_text_field(), which does not strip path traversal sequences, and then passed directly to Nbdesigner_IO::delete_folder() and PHP's rename().

Original NVD description (English source)

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS