CVE-2026-14323

Executive Summary

CVE-2026-14323 is an unauthenticated directory traversal vulnerability (CWE-22) in the Printcart Web to Print Product Designer plugin for WooCommerce, affecting all versions up to and including 2.8.5. The flaw resides in the mockups parameter and allows unauthenticated attackers to read arbitrary files on the underlying web server. Because the plugin is designed for internet-facing WooCommerce storefronts, exploitation can expose wp-config.php database credentials, secret keys, and other sensitive server files, directly enabling full site takeover or lateral movement.

Technical Analysis

The vulnerability is a classic path traversal (CWE-22) reachable through the WordPress AJAX/request surface. According to the NVD description, the mockups parameter does not adequately sanitize user-supplied path input, allowing an attacker to supply traversal sequences that escape the intended plugin directory and reference arbitrary files on the filesystem.

The plugin exposes a companion AJAX handler identified as nbd_check_use_logged_in, registered with nopriv (i.e., accessible to unauthenticated visitors). This endpoint "freely mints and returns a nbdesigner-get-data nonce to any visitor." In WordPress, nonces are frequently used as a lightweight CSRF/authorization gate on AJAX actions. Here, however, the same endpoint that supplies the nonce does not itself enforce authentication, so the nonce requirement provides effectively zero protection: any anonymous visitor can request a valid nonce and then present it to the vulnerable handler. The NVD description further notes that if the NBDESIGNER_ENABLE_NONCE constant is disabled in the site configuration, "even this nonce gate is bypassed entirely," meaning the traversal is reachable with no token at all.

The net effect is a fully unauthenticated arbitrary file read primitive. Because WordPress stores database credentials, authentication salts, and API secrets in wp-config.php, and because the web server process often has read access to files outside the web root (backups, .env files, private keys, system files), the confidentiality impact is rated High. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a base score of 7.5, reflecting network reachability, low attack complexity, no privileges required, and no user interaction. Integrity and availability are unaffected because the flaw is a read-only primitive.

No patch evidence exists from any tracked source (patch confidence 0/4), so all versions up to and including 2.8.5 remain vulnerable. No public PoC, exploit code, or Nuclei template is currently available according to the provided intelligence; the attack chain below is therefore described at the vulnerability-class level and from the explicit endpoint/parameter names given in the NVD description only.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker enumerates internet-facing WordPress sites running WooCommerce with print/product-designer functionality. Identification is possible by probing for plugin-specific assets or by fingerprinting responses from the plugin's AJAX endpoints. No credentials are required at any stage.

2. Triggering the vulnerability class. The attacker locates the endpoint that consumes the mockups parameter (a file/asset reference handler used for product mockup images). The attacker then supplies a value containing directory traversal sequences so that the resolved path escapes the intended directory and points at a target file outside the plugin (or web root) directory. This is the canonical CWE-22 exploitation pattern; the specific path payload is not disclosed in the source data.

3. Obtaining the authorization token (if required). If the NBDESIGNER_ENABLE_NONCE constant is enabled, the request must carry a valid nbdesigner-get-data nonce. The attacker retrieves one by calling the nbd_check_use_logged_in nopriv AJAX endpoint, which returns a nonce to any unauthenticated visitor. The attacker then replays the vulnerable request with that nonce appended. If NBDESIGNER_ENABLE_NONCE is disabled, this step is skipped entirely and the request is sent with no token.

4. Reading files / post-exploitation impact. The server returns the contents of the requested file. An attacker prioritizes configuration and secret material (wp-config.php, environment files, backup archives, credential stores, private keys). With leaked database credentials and WordPress salts, an attacker can pivot to direct database access, forge authentication cookies, or modify site content — resulting in full compromise of the WordPress installation and any co-hosted data the web server user can read.

No public PoC is available; the above chain is inferred from the vulnerability class (unauthenticated path traversal) and the explicit endpoint/parameter names present in the NVD description. Specific payload strings and internal function names are deliberately not fabricated.

Impact Assessment

• Confidentiality (High): Arbitrary read of server files, including wp-config.php and other secrets, giving a path to full site compromise.
• Integrity (None): The primitive is read-only; no file writes or modifications are performed by the flaw itself.
• Availability (None): No denial-of-service condition is introduced.
• CVSS 3.1 Base: 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
• Blast radius: Any WordPress + WooCommerce storefront running Printcart Web to Print Product Designer ≤ 2.8.5 that is reachable from the internet. Because exploitation is unauthenticated and requires no user interaction, mass scanning is trivial once a payload is public. Leaked database credentials can expose the entire tenant database, and co-hosted sites on shared infrastructure may be reachable by the same web server user.
• CISA KEV: Not listed. EPSS: Not yet scored by FIRST.org (no value available).

Detection Guidance

Sigma Rule

title: Printcart Web to Print Directory Traversal via mockups Parameter
id: 6f0c3a2e-printcart-cve-2026-14323
status: experimental
description: Detects directory traversal attempts against the Printcart Web to Print Product Designer plugin via the mockups parameter
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14323
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
      - 'mockups='
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
      - '/etc/passwd'
      - 'wp-config.php'
  condition: selection_param and selection_traversal
falsepositives:
  - Legitimate applications that include relative paths in the mockups parameter
level: high
tags:
  - attack.t1190
  - cve.2026.14323

YARA Rule

rule CVE_2026_14323_Printcart_Traversal
{
    meta:
        author = "valtersit.com"
        description = "Detects directory traversal payloads targeting Printcart Web to Print mockups parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14323"
        date = "2026-01-01"
        cve = "CVE-2026-14323"

    strings:
        $param = "mockups=" ascii nocase
        $nonce = "nbdesigner-get-data" ascii nocase
        $ajax = "nbd_check_use_logged_in" ascii nocase
        $t1 = "../" ascii
        $t2 = "..\\" ascii
        $t3 = "%2e%2e%2f" ascii nocase
        $t4 = "%2e%2e/" ascii nocase
        $f1 = "/etc/passwd" ascii
        $f2 = "wp-config.php" ascii

    condition:
        $param and (1 of ($t*)) and (1 of ($f*) or 1 of ($ajax, $nonce))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14323 Printcart Web to Print Directory Traversal via mockups parameter"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"mockups="; nocase; http.uri; content:"../"; distance:0; nocase; reference:cve,2026-14323; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-14323; classtype:web-application-attack; sid:202614323; rev:1;)

Elastic Detection

network where http.request.method == "GET" and
  http.request.uri contains "mockups=" and
  (http.request.uri contains "../" or
   http.request.uri contains "..%2f" or
   http.request.uri contains "%2e%2e%2f" or
   http.request.uri contains "wp-config.php" or
   http.request.uri contains "/etc/passwd")

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_query, "(?i)mockups=")
| where match(uri_query, "(?i)(\.\./|\.\.%2f|%2e%2e%2f|%2e%2e/|wp-config\.php|/etc/passwd)")
| eval client_ip = coalesce(src_ip, clientip)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by client_ip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-14323,">
  <rule id="202614323" level="12">
    <if_sid>31100</if_sid>
    <url>/mockups=</url>
    <match>\.\./|\.\.%2f|%2e%2e%2f|%2e%2e/|wp-config\.php|/etc/passwd</match>
    <description>CVE-2026-14323: Printcart Web to Print directory traversal attempt via mockups parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_14323,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Virtual patching / WAF: Deploy a rule blocking requests where mockups contains traversal sequences (../, encoded variants, or absolute-path/known-file targets such as wp-config.php). The Suricata and Sigma rules above can be adapted as blocking signatures.
   • Restrict the nopriv endpoint: Disable or firewall the nbd_check_use_logged_in AJAX action if print-designer functionality is not required. If NBDESIGNER_ENABLE_NONCE is configurable in your deployment, ensure it is enabled so the nonce gate is at least present.
   • Least privilege: Run PHP-FPM/the web server as a low-privilege user with no read access beyond the web root, and move backups, .env files, and private keys outside readable scope. Harden open_basedir where feasible.
   • Access control: If the design feature is not used by the public, restrict access to the plugin's AJAX endpoints by IP or require authentication at the reverse proxy.

2. Patch / upgrade steps:

   • No vendor fix is available for versions ≤ 2.8.5. Monitor the Printcart/Web to Print Product Designer vendor channel for an official release and upgrade immediately when published.
   • If no fix is forthcoming, decommission or replace the plugin.

3. Long-term hardening:

   • Maintain a WordPress component inventory and track plugin CVEs (WPScan, Patchstack, NVD).
   • Rotate all secrets stored in wp-config.php (DB password, salts, API keys) if compromise is suspected; leaked credentials enable full takeover.
   • Enforce file-system least privilege, disable file editing via DISALLOW_FILE_EDIT, and monitor web-server logs for traversal patterns.
   • Subscribe to vendor advisories and set alerting on KEV/NVD updates for this CVE.

References

• NVD — CVE-2026-14323: https://nvd.nist.gov/vuln/detail/CVE-2026-14323
• CWE-22 — Path Traversal: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security / WPScan vulnerability database: https://wpscan.com/
• Printcart Web to Print Product Designer for WooCommerce (vendor product page; monitor for advisory)

Threat actor / exploit-in-the-wild evidence: None provided. CVE-2026-14323 is not in CISA KEV, no public PoC/exploit code or Nuclei template is available per the supplied data, and EPSS has not yet scored the CVE. Detection should rely on the virtual-patching and log-based rules above until a public exploit emerges.