CVE-2026-93388 printcart CVE debrief

Who should care

Defenders responsible for the security of WooCommerce installations with the Printcart Store – Web to Print Product Designer for WooCommerce plugin should assess exposure and prioritize remediation or compensating controls.

Why it matters

The CVE-2026-93388 vulnerability in the Printcart Store – Web to Print Product Designer for WooCommerce plugin poses a critical risk due to its potential for unauthenticated arbitrary file upload and remote code execution. Defenders should prioritize verifying exposure, assessing the need for immediate remediation or compensating controls, and monitoring for potential exploitation attempts. The vulnerability affects versions up to and including 2.9.1, and updating to a fixed version is recommended.

• Potential remote code execution on the server.
• Unauthenticated arbitrary file upload vulnerability.
• Possible exploitation attempts via the nbdesigner_copy_image_from_url AJAX action.
• Need for verification of exposure and remediation.

Technical summary

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/).

Defensive priority

Defenders should prioritize verifying exposure and remediation for the Printcart Store – Web to Print Product Designer for WooCommerce plugin, particularly for versions up to and including 2.9.1.

Recommended defensive actions

• Verify exposure of the Printcart Store – Web to Print Product Designer for WooCommerce plugin, particularly for versions up to and including 2.9.1.
• Assess the need for immediate remediation or compensating controls.
• Monitor for potential exploitation attempts.
• Update to a fixed version if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the unauthenticated arbitrary file upload vulnerability in the Printcart Store – Web to Print Product Designer for WooCommerce plugin, which could lead to remote code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.