CVE-2026-93388
Deferred Deferred - Pending Action

Unauthenticated Arbitrary File Upload in Printcart Store Plugin for WooCommerce

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-93388
EUVD
EUVD-2026-100765

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
printcart Printcart Store – Web to Print Product Designer for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated attackers to upload arbitrary files to a web-accessible directory on a WordPress site using the Printcart Store plugin. The flaw exists in the nbdesigner_copy_image_from_url AJAX action, which bypasses file type restrictions for Google Drive files. Attackers can upload a PHP file and execute arbitrary code on the server.

Detection Guidance

Check for unauthorized PHP files in wp-content/uploads/nbdesigner/temp/ and review logs for nbdesigner_copy_image_from_url AJAX requests. Look for suspicious Google Drive file fetches or unexpected file writes.

Impact Analysis

This vulnerability can lead to complete server compromise. Attackers can execute malicious code, steal sensitive data, install backdoors, or take control of the entire website and server. It poses a severe risk to website integrity and user data.

Compliance Impact

This vulnerability can lead to data breaches, exposing sensitive user data. It may violate GDPR (data protection) and HIPAA (health information privacy) by allowing unauthorized access to personal or health data, resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Printcart Store plugin to the latest version beyond 2.9.1. Disable the nbdesigner_copy_image_from_url AJAX action if not needed. Restrict write permissions to wp-content/uploads/nbdesigner/temp/ and block PHP execution in that directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart