Directory Traversal Vulnerability in Printcart Plugin for WooCommerce by WordPress

CVE-2026-14323

What is CVE-2026-14323?

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress has a directory traversal vulnerability that impacts all versions up to 2.8.5. Exploiting this flaw allows unauthenticated attackers to access and read arbitrary files on the server, potentially exposing sensitive information. The vulnerability is facilitated through the 'mockups' parameter, and an attacker can easily obtain a valid nonce by interacting with the nbd_check_use_logged_in nopriv AJAX endpoint. Disabling the NBDESIGNER_ENABLE_NONCE constant further removes any nonce protection, making it simpler for malicious users to exploit this weakness.

References