A critical arbitrary file deletion vulnerability in the Printcart WordPress plugin allows unauthenticated attackers to execute unauthorized file operations, potentially leading to remote code execution.

The plugin fails to perform adequate path validation on the 'nbd_item_key' parameter and fails to properly secure the nonce required for the nbd_save_customer_design action, allowing unauthenticated attackers to delete arbitrary files.

This vulnerability is rated 9.1 (Critical) as it facilitates arbitrary file deletion, which can be chained to achieve Remote Code Execution (RCE). The impact includes complete site compromise, data loss, and potential total loss of control over the WordPress server environment, posing a severe threat to business continuity.

Immediate Action: Update the Printcart Web to Print Product Designer for WooCommerce plugin to the latest version immediately.

Proactive Monitoring: Monitor server filesystem integrity and review web server logs for suspicious POST requests targeting the plugin's AJAX endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing directory traversal sequences or unauthorized attempts to access sensitive plugin functions.

Public Exploit Available: False

This vulnerability is highly dangerous because it allows unauthenticated attackers to perform destructive actions on the server. Site administrators must update the plugin immediately to the latest patched version to prevent potential RCE and complete site takeover.