CVE-2026-9725 is a path traversal vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin for WordPress, affecting versions <=2.5.2. The vulnerability arises from inadequate sanitization of the 'nbd_item_key' POST parameter in the store_design_data() function, which is sanitized only with sanitize_text_field(), a method that does not remove path traversal sequences. This parameter is then used directly in filesystem operations such as Nbdesigner_IO::delete_folder() and PHP's rename(), enabling arbitrary file deletion. Additionally, the nonce protecting the AJAX action nbd_save_customer_design can be obtained by unauthenticated users via the nbd_check_use_logged_in endpoint, allowing exploitation without authentication. The CVSS 3.1 base score is 9.1, reflecting critical severity with network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.

An unauthenticated attacker can delete arbitrary files on the affected server by exploiting the path traversal vulnerability. This can cause denial of service by removing critical files and may enable remote code execution if key files are deleted or replaced. The integrity and availability of the affected system are severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected AJAX endpoints and monitor for suspicious activity. Avoid exposing the vulnerable plugin on publicly accessible sites or disable it if possible. Follow vendor updates closely for an official fix.