CVE-2026-9725 is a critical path traversal vulnerability (CWE-22) in the Printcart Web to Print Product Designer for WooCommerce plugin. The vulnerability arises from inadequate sanitization of the 'nbd_item_key' POST parameter in the store_design_data() function. This parameter is sanitized only with sanitize_text_field(), which does not remove path traversal sequences. The constructed path is then passed to Nbdesigner_IO::delete_folder() and PHP's rename() functions, enabling arbitrary file deletion. Additionally, the nonce protecting the nbd_save_customer_design AJAX action is accessible to unauthenticated users via the nbd_check_use_logged_in endpoint, allowing exploitation without authentication. This can lead to arbitrary file deletion on the server, potentially enabling remote code execution.

An unauthenticated attacker can delete arbitrary files on the affected server, which may cause denial of service or enable further attacks such as remote code execution. The vulnerability compromises the integrity and availability of the server hosting the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX endpoints if possible and monitor for suspicious activity related to the plugin. Avoid exposing the vulnerable plugin on publicly accessible sites without additional protective controls.