CVE-2026-14323: Printcart WordPress Path Traversal Flaw

CVE-2026-14323 Overview

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress contains a directory traversal vulnerability affecting all versions up to and including 2.8.5. The flaw resides in the mockups parameter, which fails to sanitize user-supplied path input. Unauthenticated attackers can read arbitrary files on the underlying server, exposing sensitive configuration data, credentials, and application source code. The plugin also exposes an unauthenticated AJAX endpoint (nbd_check_use_logged_in) that mints valid nbdesigner-get-data nonces for any visitor, defeating the nonce gate intended to restrict access. When the NBDESIGNER_ENABLE_NONCE constant is disabled, the nonce check is bypassed entirely.

Critical Impact
Unauthenticated remote attackers can read arbitrary files including wp-config.php, exposing database credentials and WordPress authentication keys.

Affected Products

Printcart Web to Print Product Designer for WooCommerce plugin for WordPress
All versions up to and including 2.8.5
WordPress sites running the printcart-integration plugin

Discovery Timeline

2026-09-18 - CVE-2026-14323 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-14323

Vulnerability Analysis

The vulnerability is a path traversal flaw [CWE-22] in the plugin's mockup file handler. The mockups parameter is passed to file read operations without normalization or restriction to an allowed base directory. An attacker supplies traversal sequences such as ../../../../ to escape the intended directory and reference arbitrary files readable by the web server user.

The issue is compounded by two authentication weaknesses. First, the nbd_check_use_logged_in AJAX endpoint is registered as nopriv, meaning unauthenticated visitors can invoke it. The endpoint returns a fresh nbdesigner-get-data nonce to any caller, so the nonce check protecting the vulnerable handler provides no meaningful access control. Second, when the NBDESIGNER_ENABLE_NONCE constant is set to a disabled state, the nonce verification is skipped entirely, removing even that weak barrier.

See the Wordfence Vulnerability Report and the vulnerable code paths in the Printcart Resource Class for technical detail.

Root Cause

The root cause is missing input validation on the mockups request parameter before it is used in file system operations. The plugin does not enforce a canonical base path, does not reject traversal sequences, and does not validate that the resolved path resides within an allowed directory.

Attack Vector

An attacker sends an HTTP request to the WordPress site's AJAX endpoint, first calling nbd_check_use_logged_in to obtain a valid nonce. The attacker then submits a request to the vulnerable action containing a mockups value with directory traversal sequences pointing to a target file such as wp-config.php. The server returns the file contents to the unauthenticated caller.

Exploitation requires only network access to the WordPress site. No user interaction or authenticated session is needed. See the plugin change log for the corresponding fix commit.

Detection Methods for CVE-2026-14323

Indicators of Compromise

HTTP requests to admin-ajax.php with action=nbd_check_use_logged_in originating from unauthenticated sources
HTTP requests to admin-ajax.php containing a mockups parameter with traversal sequences such as ../, ..%2f, or %2e%2e%2f
Successful responses returning file content matching WordPress configuration signatures such as DB_PASSWORD or AUTH_KEY
Web server access to wp-config.php, /etc/passwd, or private key files from the PHP worker process

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to alert on requests containing traversal sequences in the mockups parameter
Monitor WordPress admin-ajax.php logs for high-volume unauthenticated calls to nbd_check_use_logged_in
Correlate nonce-mint requests with immediate follow-up requests referencing nbdesigner-get-data
Baseline expected file access patterns for the PHP worker and alert on reads of sensitive configuration files

Monitoring Recommendations

Ingest WordPress access logs and PHP error logs into a centralized logging platform for retention and analysis
Alert on any HTTP 200 response to a mockups-bearing request that exceeds a size threshold associated with normal image mockup output
Track outbound web server file reads to paths outside the plugin's upload directory
Review historical logs for the indicators above to identify pre-patch exploitation

How to Mitigate CVE-2026-14323

Immediate Actions Required

Update the Printcart Web to Print Product Designer for WooCommerce plugin to a version later than 2.8.5 once the vendor publishes a fixed release
If no patched version is available, disable and remove the printcart-integration plugin from the WordPress installation
Rotate all secrets stored in wp-config.php, including database credentials, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY
Audit the WordPress site for indicators of file exfiltration and unauthorized administrative activity

Patch Information

Refer to the Printcart plugin change log for commit-level fix details, and the Wordfence Vulnerability Report for the vendor's remediation status. Apply the update through the WordPress plugin manager once available.

Workarounds

Block requests to admin-ajax.php where the action parameter equals nbd_check_use_logged_in at the WAF or reverse proxy
Reject requests where the mockups parameter contains ../, ..\, or URL-encoded traversal variants
Restrict file system permissions so the PHP worker cannot read wp-config.php or files outside the WordPress web root
Enable the NBDESIGNER_ENABLE_NONCE constant if it has been disabled, acknowledging this only narrows the exposure rather than eliminating it

bash

# Example ModSecurity rule to block traversal in the mockups parameter
SecRule ARGS:mockups "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1014323,phase:2,deny,status:403,\
    msg:'CVE-2026-14323 Printcart mockups traversal attempt',\
    tag:'CWE-22'"