Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19803— Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter

Quick assessment

Affected
printcart Printcart Store – Web to Print Product Designer for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Printcart Store – Web to Print Product Designer for WooCommerce 插件在所有 2.13.2 及之前的版本中均存在任意文件上传漏洞。该漏洞源于 AJAX 处理器会接受用户提供的 参数，而 方法在将该参数拼接到上传基础目录时，未对路径进行规范化或过滤 序列；随后，系统又通过 从同一攻击者控制的路径中推导输出目录和输出文件扩展名，且在调用 之前未执行 验证。这使得未认证的攻击者能够将攻击者控制的 PHP 内容写入上传目录之外的任意位置，

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19803

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
printcart Printcart Store – Web to Print Product Designer for WooCommerce 0 ~ 2.13.2 -

II. Public POCs for CVE-2026-19803

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19803

请登录查看更多情报信息。

Other References for CVE-2026-19803 (7)

IV. Related Vulnerabilities

Same product: Printcart Store – Web to Print Product Designer for WooCommerce
Same vendor: printcart
Same weakness: CWE-94