CVE-2026-9725 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-9725 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-9725 is an Arbitrary File Deletion vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin for WordPress, affecting all versions up to and including 2.5.2.

Technical Detail

The flaw stems from insufficient path validation when the plugin processes file deletion requests, allowing an attacker to supply a crafted path that traverses outside the intended directory scope. By exploiting this weakness, an attacker can delete arbitrary files on the underlying server filesystem, including critical WordPress configuration files such as wp-config.php, which could render the site inoperable or expose sensitive credentials upon reconstruction. In a worst-case scenario, deletion of core files could be chained with other techniques to facilitate further compromise, including unauthorized access or site takeover.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently unverified, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been confirmed as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability.

What To Do

Update the Printcart Web to Print Product Designer for WooCommerce plugin to a version beyond 2.5.2 immediately once a patched release is available from the vendor. If no patch is currently available, the recommended interim measure is to deactivate and remove the plugin until a fix is issued. Site administrators should audit server-side file integrity and review web server access logs for anomalous DELETE or POST requests targeting plugin endpoints. Restricting file system permissions so that the web server process cannot delete files outside the WordPress upload directory provides an additional layer of defense. Monitor the WordPress plugin repository and the vendor's release channel for patch availability and apply updates promptly given the critical CVSS score of 9.1.