Printus <= 2.0.6 - Authenticated (Shop Manager+) Path Traversal to Local File Inclusion via Template Name
- ID
- WPSEC-2026-1230
- Plugin
- Printus – Automatic Cloud Order Printing for WooCommerce (printus-cloud-printing-for-woocommerce)
- Affected
- from 1.1.0 before 2.1.0
- Remediation
- Update to 2.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-98
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-18
- Attack surface
- Printus on WPSec AttackSurface
- Fix released
- Published
Description
The Printus plugin for WordPress is vulnerable to Path Traversal leading to Local File Inclusion via the 'template' parameter of the order edit screen's on-demand print feature in all versions up to, and including, 2.0.6. This is due to the plugin appending the user-supplied template name directly to the custom templates directory path and including the resulting file without removing directory traversal sequences. This makes it possible for authenticated attackers with Shop Manager-level access and above to include and execute arbitrary .php files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution where PHP files can be placed on the server. Exploitation requires a custom templates folder to be present, either printus/templates in the active theme or the Printus Custom Templates plugin folder.
References
- https://wpsec.com/vuln/WPSEC-2026-1230/
- https://plugins.svn.wordpress.org/printus-cloud-printing-for-woocommerce/tags/2.1.0/
- https://wordpress.org/plugins/printus-cloud-printing-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS