The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to an arbitrary file deletion flaw in all releases up to and including version 2.5.2. The vulnerability stems from insufficient path validation in the store_design_data() function, where a user‑supplied 'nbd_item_key' POST parameter is sanitised only with sanitize_text_field()—which does not strip path‑traversal sequences—before being concatenated into a filesystem path. That path is then passed directly to Nbdesigner_IO::delete_folder() and PHP's rename() functions, allowing an attacker to delete any file on the server. By removing or altering critical files, an attacker could potentially create conditions that lead to remote code execution; this possibility is inferred from the description, as the plugin may execute arbitrary PHP code stored under the shop’s file system. The vulnerability is a CWE‑22 (Path Traversal).

The Printcart Web to Print Product Designer for WooCommerce plugin developed by printcart. Versions 2.5.2 and all earlier releases are susceptible to the flaw.

CVSS score 9.1 indicates a high‑severity vulnerability, while EPSS < 1% indicates a low but non‑zero probability of exploitation in the wild. The nonce that protects the nbd_save_customer_design AJAX action can be obtained via the publicly available nbd_check_use_logged_in endpoint, enabling unauthenticated attackers to obtain a valid nonce. An attacker can then send a crafted POST request to nbd_save_customer_design containing a path‑traversal payload and the acquired nonce to delete arbitrary files on the server. Because this action does not require authentication and could allow removal of key files, it may set the stage for remote code execution, though this chain is inferred rather than confirmed. The exploit is not listed in CISA’s KEV catalog.