Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93388— Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

Quick assessment

Affected
printcart Printcart Store – Web to Print Product Designer for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce 的 Printcart Store（PCDesigner / NB Designer）插件在所有 2.9.1 及更早版本中存在漏洞，该漏洞允许未认证的攻击者进行任意文件上传，从而导致远程代码执行。 该漏洞源于 这个 AJAX 操作被注册为对未登录用户（ ）开放。其 Google Drive 分支会从攻击者提供的原始 参数中直接重建目标文件名，从而绕过了在其他分支中所应用的 jpg/jpeg/png/gif 扩展名白名单限制。随后，插件将从指定来源获取的字节数据写入到一个可通过 Web 访问的

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93388

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
Source: CVE Program / CVE List V5
Vulnerability Description
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
printcart Printcart Store – Web to Print Product Designer for WooCommerce 0 ~ 2.9.1 -

II. Public POCs for CVE-2026-93388

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93388

请登录查看更多情报信息。

Other References for CVE-2026-93388 (3)

IV. Related Vulnerabilities

Same product: Printcart Store – Web to Print Product Designer for WooCommerce
Same vendor: printcart
Same weakness: CWE-434

V. Comments for CVE-2026-93388

No comments yet

Leave a comment