Printcart Web to Print Product Designer for WooCommerce is vulnerable to arbitrary file deletion in all versions up to 2.5.2. The flaw arises in the store_design_data() function, which builds a filesystem path from the user‑supplied 'nbd_item_key' POST parameter. Only sanitize_text_field fails to strip path‑traversal sequences, allowing a constructed path outside the intended directory. That path is then passed to delete_folder() and PHP's rename(), permitting deletion of any file on the web server. Additionally, the nonce that protects the nbd_save_customer_design AJAX action can be freely obtained by unauthenticated users via the nbd_check_use_logged_in endpoint, so an attacker can acquire the necessary token without authentication. Because arbitrary file deletion can remove or alter executables and critical configuration files, an unauthenticated attacker could potentially gain remote code execution.

The affected vendor is Printcart, with the product Printcart Web to Print Product Designer for WooCommerce. All releases up to and including version 2.5.2 are impacted. The vulnerability is present whenever the plugin is installed without applying the patch delivered in version 2.5.3.

The CVSS score of 9.1 places the vulnerability in the Critical category. The EPSS score is < 1%, indicating a low probability of exploitation in the wild. Exploitation requires no authentication because the nonce needed for the nbd_save_customer_design action is exposed through the nbd_check. By first obtaining that nonce and then submitting a path‑traversal payload in the nbd_item_key parameter, an attacker can delete arbitrary files, including executables and configuration files, which may lead to remote code execution. The vulnerability is not listed in CISA’s KEV catalog; however, the straightforward nature and lack of authentication barriers make the risk significant.