# Printus <= 2.0.6 - Authenticated (Shop Manager+) Path Traversal to Local File Inclusion via Template Name

- **ID:** WPSEC-2026-1230
- **Plugin:** Printus – Automatic Cloud Order Printing for WooCommerce (`printus-cloud-printing-for-woocommerce`), https://wordpress.org/plugins/printus-cloud-printing-for-woocommerce/
- **Affected versions:** from 1.1.0 before 2.1.0
- **Fixed in:** 2.1.0 (Update to 2.1.0 or later.)
- **Severity:** Medium 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-98
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/printus-cloud-printing-for-woocommerce
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1230/

## Description

The Printus plugin for WordPress is vulnerable to Path Traversal leading to Local File Inclusion via the 'template' parameter of the order edit screen's on-demand print feature in all versions up to, and including, 2.0.6. This is due to the plugin appending the user-supplied template name directly to the custom templates directory path and including the resulting file without removing directory traversal sequences. This makes it possible for authenticated attackers with Shop Manager-level access and above to include and execute arbitrary .php files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution where PHP files can be placed on the server. Exploitation requires a custom templates folder to be present, either printus/templates in the active theme or the Printus Custom Templates plugin folder.

## References

- https://wpsec.com/vuln/WPSEC-2026-1230/
- https://plugins.svn.wordpress.org/printus-cloud-printing-for-woocommerce/tags/2.1.0/
- https://wordpress.org/plugins/printus-cloud-printing-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1230/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.