Read the docs
TI-2026-73781 Aliases CVE-2026-93388GHSA-p5c5-938c-g6r5

Unrestricted file upload in Printcart PCDesigner WooCommerce plugin

Priority MEDIUM 50CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is affected up to and including 2.9.1. The nbdesigner_copy_image_from_url AJAX action, available to logged-out users, rebuilds the Google Drive destination filename from an attacker-supplied parameter and skips the image extension allow-list, which is CWE-434 (unrestricted upload of file with dangerous type). An unauthenticated remote attacker can write a PHP file to a web-accessible directory and execute arbitrary code on the server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00854 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
printcartPrintcart Store – Web to Print Product Designer for WooCommerceup to 2.9.1—No fix listedCNA
  • Printcart Store – Web to Print Product Designer for WooCommerce Vendorprintcart Affected up to 2.9.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Printcart Store (Web to Print Product Designer for WooCommerce).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-93388
  2. 2026-10-14 Alias added: GHSA-p5c5-938c-g6r5
  3. 2026-10-15 CISA SSVC decision points changed

References

Other 3

  • TI-2025-30138 WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.3.9 - Arbitrary File Upload Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-08523 Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion CVSS 3.1CRITICAL 9.1
  • TI-2025-30137 WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2026-86189 Arbitrary file upload in Printcart Store for WooCommerce CVSS 3.1CRITICAL 9.8
  • TI-2026-12113 Path traversal in Printcart Store – Web to Print Product Designer for WooCommerce CVSS 3.1HIGH 7.5
  • TI-2025-18497 WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability CVSS 3.1HIGH 8.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences