CVE-2025-15662: Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Printcart Web to Print Product Designer for WooCommerceto a version that resolves this vulnerability.Fixed in 2.5.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.
What could an attacker access through the vulnerable endpoint?
The issue can allow reading arbitrary local files, including configuration files that may contain database credentials and secret keys. It can also be used to make requests from the server to internal resources.
Which installations are affected?
Printcart Web to Print Product Designer for WooCommerce versions before 2.5.3 are affected. The provided information does not identify any configuration prerequisite.