{
 "id": "WPSEC-2026-1230",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1230/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1230/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1230/index.md",
 "title": "Printus <= 2.0.6 - Authenticated (Shop Manager+) Path Traversal to Local File Inclusion via Template Name",
 "description": "The Printus plugin for WordPress is vulnerable to Path Traversal leading to Local File Inclusion via the 'template' parameter of the order edit screen's on-demand print feature in all versions up to, and including, 2.0.6. This is due to the plugin appending the user-supplied template name directly to the custom templates directory path and including the resulting file without removing directory traversal sequences. This makes it possible for authenticated attackers with Shop Manager-level access and above to include and execute arbitrary .php files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution where PHP files can be placed on the server. Exploitation requires a custom templates folder to be present, either printus/templates in the active theme or the Printus Custom Templates plugin folder.",
 "plugin": {
  "slug": "printus-cloud-printing-for-woocommerce",
  "name": "Printus",
  "full_name": "Printus – Automatic Cloud Order Printing for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/printus-cloud-printing-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/printus-cloud-printing-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/printus-cloud-printing-for-woocommerce"
 },
 "type": "LFI",
 "cwe": [
  "CWE-98"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.1.0",
    "from_inclusive": true,
    "to": "2.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.1.0 before 2.1.0"
  ]
 },
 "introduced_in": "1.1.0",
 "fixed_in": "2.1.0",
 "remediation": "Update to 2.1.0 or later.",
 "fix_released": "2026-10-17T15:50:33+00:00",
 "published": "2026-10-18T16:42:51+00:00",
 "updated": "2026-10-18T10:55:51.115480+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1230/",
  "https://plugins.svn.wordpress.org/printus-cloud-printing-for-woocommerce/tags/2.1.0/",
  "https://wordpress.org/plugins/printus-cloud-printing-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/printus-cloud-printing-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-18"
 }
}