Printcart unauthenticated URL fetch permits local file read and SSRF
Printcart Web to Print Product Designer for WooCommerce before 2.5.3 exposes an unauthenticated server-side URL fetch without restricting the requested scheme or destination. An attacker can make the plugin read local files such as wp-config.php, exposing database credentials and WordPress secret keys, or send requests to internal network services. The CNA record does not disclose the handler, action, URL parameter or fetch function.
- Component
- Printcart Web to Print Product Designer for WooCommerce
- Affected
- < 2.5.3
- Safe version
2.5.3- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or later. Rotate database credentials and WordPress salts if local files may have been exposed, and review outbound and application logs for requests to local, metadata or internal-network addresses.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N