CVE-2025-15662
Deferred Deferred - Pending Action

Server-Side Request Forgery in Printcart Web to Print Product Designer

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: WPScan

Description
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-08-16
AI Q&A
2026-07-27
EPSS Evaluated
2026-08-15
NVD
CVE-2025-15662
EUVD
EUVD-2025-210510

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
printcart web_to_print_product_designer to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Printcart Web to Print Product Designer for WooCommerce WordPress plugin before version 2.5.3. It allows unauthenticated attackers to read arbitrary local files, including sensitive configuration files with database credentials and secret keys, by exploiting insufficient URL validation and lack of authorization checks. Attackers can also perform server-side request forgery (SSRF) attacks against internal resources.

Detection Guidance

Check if the Printcart Web to Print Product Designer for WooCommerce plugin is installed and if its version is prior to 2.5.3. You can use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details. Look for unauthorized file reads or SSRF attempts in server logs.

Impact Analysis

If you use the vulnerable plugin version, attackers could access sensitive data like database credentials and secret keys stored on your server. They could also make unauthorized requests to internal services, potentially leading to further compromise of your system or data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the Printcart Web to Print Product Designer plugin to version 2.5.3 or later immediately. If updating is not possible, consider disabling or removing the plugin until a patch is applied. Review server logs for signs of exploitation and restrict access to sensitive files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart