CVE-2026-14323 printcart CVE debrief

Who should care

Defenders responsible for WordPress installations with the vulnerable plugin should assess exposure and prioritize verification and remediation. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure to the vulnerability, especially those managing WordPress installations with the vulnerable plugin, as they are at risk of potential security breaches.

Why it matters

The vulnerability allows unauthenticated attackers to read arbitrary files on the server, which can contain sensitive information. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure.

• Unauthenticated attackers can read arbitrary files on the server
• Sensitive information can be obtained by attackers

Technical summary

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This vulnerability allows unauthenticated attackers to read arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure.

Recommended defensive actions

• Verify the presence of the vulnerable plugin in your WordPress installation
• Assess exposure to the vulnerability
• Consider updating the plugin to a version that addresses the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows unauthenticated attackers to read arbitrary files on the server. A valid nonce can be obtained by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.