Cyber & AI intelligence
Wasteland.
Briefs indexed3530
Issues35
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-19803 2026-11-07

CVE-2026-19803: Unauthenticated RCE in Printcart Web to Print Plugin for WooCommerce

"A critical (CVSS 9.8) path traversal flaw in the Printcart Store – Web to Print Product Designer for WooCommerce plugin lets unauthenticated attackers write PHP files outside the uploads directory. This works only on…"

A critical (CVSS 9.8) path traversal flaw in the Printcart Store – Web to Print Product Designer for WooCommerce plugin lets unauthenticated attackers write PHP files outside the uploads directory. This works only on sites that use the Advanced Upload Popup setting. Whether a written file can then run code depends on the server's filesystem permissions and on whether the file lands where the server will execute PHP.

What Is It

CVE-2026-19803 is an arbitrary file upload vulnerability in the Printcart Store – Web to Print Product Designer plugin for WordPress, classified as CWE-94 (Code Injection). It sits in the plugin's nbu_crop_image AJAX handler. That handler takes a user-supplied url parameter and passes it to Nbdesigner_IO::convert_url_to_path(), which appends it to the uploads base directory without normalizing it or removing ../ sequences.

The handler then uses pathinfo() on that same attacker-controlled path to decide both the output directory and the file extension. It calls writeImage() without calling stripImage() first. As a result, an attacker can use ../ sequences to write a file containing attacker-supplied PHP content outside the uploads directory. Which locations can actually be written depends on the web server's filesystem permissions. If the file lands in a web-accessible location where the server executes PHP, requesting it can run the embedded code.

Why It Matters

Wordfence rates the flaw 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It can be exploited over the network with low complexity, no privileges and no user interaction. It can lead to remote code execution on the WordPress host when the written file ends up in a web-accessible location that executes PHP and filesystem permissions allow the write.

One configuration condition applies. The flaw can only be exploited when the nbdesigner_upload_popup_style site option is set to a (Advanced Upload Popup), because that setting registers the handler for unauthenticated requests. The handler needs a save-design nonce, but the plugin prints that nonce on the public frontend upload-design-file page, so any anonymous visitor can get it once this setting is on.

Exploitation status: The CISA Known Exploited Vulnerabilities Catalog has no entry for this CVE, so KEV does not confirm active exploitation at this time.

What's Vulnerable

Patch Status

The supplied data does not name a fixed version. NVD lists a WordPress plugin Trac changeset among the references, but neither the KEV nor the NVD record states a patched release or a required action. NVD shows the record as "Deferred," published 2026-11-07.

Administrators running version 2.13.2 or earlier should check the Wordfence advisory for remediation guidance. They should also check whether their site has the Advanced Upload Popup option enabled, since that setting is what makes the flaw exploitable.

Sources