Directory Traversal in Printcart Web to Print Product Designer for WooCommerce

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to a directory traversal flaw in versions 2.8.5 and earlier. The vulnerability exists within the 'mockups' parameter, allowing unauthenticated attackers to access and read sensitive files from the underlying server filesystem.

The exploitation process is simplified by the plugin's insecure implementation of nonce validation. Unauthenticated users can retrieve a valid 'nbdesigner-get-data' nonce from the 'nbd_check_use_logged_in' AJAX endpoint. Furthermore, if the 'NBDESIGNER_ENABLE_NONCE' constant is explicitly set to false, the security gate is removed entirely, allowing direct exploitation of the traversal vulnerability. This flaw poses a significant risk to affected WordPress installations, as it facilitates the exfiltration of sensitive configuration files, including wp-config.php, which often contains database credentials.