WordPress Plugin Path Traversal Enables Arbitrary File Deletion

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible.

Casky was already ahead

This CVE exploits attack patterns that Casky's 347matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Printcart Web to Print Product Designer plugin for WooCommerce contains a critical arbitrary file deletion vulnerability affecting versions up to 2.5.2. The flaw exists in the store_design_data() function, which fails to properly validate the 'nbd_item_key' POST parameter before constructing filesystem paths. Although the plugin applies sanitize_text_field() to user input, this function does not remove path traversal sequences like "../", allowing attackers to delete arbitrary files on the server. Any WordPress site running this plugin becomes a target for unauthenticated adversaries seeking to destroy critical application files, configuration data, or backups—potentially causing complete service disruption or enabling subsequent attacks that exploit the damaged system state.

Casky.ai's 754 mapped security skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would observe detections flagging unsafe input sanitization patterns tied to path traversal (CWE-22), combined with behavioral patterns consistent with file system reconnaissance and destruction activities. The platform's skill set would identify the specific attack chain: POST parameter manipulation → insufficient validation → arbitrary file deletion, and surface findings that highlight how attackers probe for writable directories before executing destructive payloads. Security teams gain visibility into both the code-level weakness and the adversarial techniques exploiting it, enabling faster response and remediation prioritization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

347 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9725.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-9725

Casky has 347 skills that investigate the attack patterns behind CVE-2026-9725. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn