CVE-2026-9725

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible.

• CWE-22

• https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.4.8/includes/class.nbdesigner.php#L214
• https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.4.8/includes/class.nbdesigner.php#L3246
• https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.4.8/includes/class.nbdesigner.php#L3698
• https://plugins.trac.wordpress.org/changeset/3593521/printcart-integration/trunk/includes/class.nbdesigner.php
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fprintcart-integration/tags/2.5.2&new_path=%2Fprintcart-integration/tags/2.5.3
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5bb962bd-9b23-4820-885e-d8095250c3c7?source=cve

Published

Jul 3, 2026

Last Modified

Jul 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9719The LatePoint – Calendar Booking Plugin for Appointments and…4.3
• CVE-2026-9720The Facturación Electrónica Costa Rica plugin for WordPress …4.3
• CVE-2026-9721The Book a Room Event Calendar plugin for WordPress is vulne…4.3
• CVE-2026-9722The Laiser Tag plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2026-9723The Google Plus One Bottom plugin for WordPress is vulnerabl…4.3
• CVE-2026-9724The MotorDesk plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2026-9726Improperly Controlled Modification of Dynamically-Determined…9.8
• CVE-2026-9729The Webpushr Push Notifications plugin for WordPress is vuln…6.4
• CVE-2026-9730The Remove NoFollow Commenter URL plugin for WordPress is vu…4.3
• CVE-2026-9731The Wp Js Detect plugin for WordPress is vulnerable to Cross…4.3
• CVE-2026-9732The EmergencyWP – Dead Man's switch & legacy deliverance plu…4.3
• CVE-2026-9733Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17…9.1