CVE-2026-14323: Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbdcheckuseloggedin nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNERENABLENONCE constant is disabled, even this nonce gate is bypassed entirely.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it. No account, privileges, or user interaction are required.
Is a default nonce check an effective protection?
No. Unauthenticated visitors can obtain the required nbdesigner-get-data nonce through the nbd_check_use_logged_in nopriv AJAX endpoint; if NBDESIGNER_ENABLE_NONCE is disabled, the nonce requirement is bypassed entirely.
What information could be exposed?
An attacker can read arbitrary files on the server through directory traversal using the mockups parameter. Exposed files may contain sensitive information.
Which installations should be investigated?
Investigate sites using Printcart Web to Print Product Designer for WooCommerce version 2.8.5 or earlier. Review web and application logs for requests involving the mockups parameter and the nbd_check_use_logged_in AJAX endpoint.