A critical (CVSS 9.8) unauthenticated arbitrary file upload flaw in the Printcart Store (PCDesigner / NB Designer) WooCommerce plugin, through version 2.9.1, lets remote attackers write PHP files to a web-accessible directory and run code on the server.
What Is It
CVE-2026-93388 is an unrestricted file upload weakness (CWE-434) in the Printcart Store – Web to Print Product Designer for WooCommerce plugin. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out users through wp_ajax_nopriv_. Its Google Drive code path builds the destination filename directly from the attacker-supplied gapi[name] parameter. That skips the jpg/jpeg/png/gif allow-list that the other code path enforces. The fetched content is then written to wp-content/uploads/nbdesigner/temp/, which is served by the web server.
An attacker can use their own Google Drive file and OAuth token as the content source. This lets them drop a .php file into a directory where PHP runs, and then execute arbitrary code with the privileges of the web server process. The action needs a save-design nonce, but the nbd_check_use_logged_in endpoint gives that nonce to anonymous callers, so it does not block the attack.
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - No authentication or user interaction required. The attack works over the network and has low complexity.
- Code execution as the web server user. A successful attack gives the attacker code execution in the context of the web server/PHP process. The CVSS vector rates confidentiality, integrity and availability impact as high. How far an attacker can go beyond that, such as reaching the WordPress database, other sites on the same host or the underlying OS, depends on the server's privilege separation and hardening.
At the time of writing, the CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, so active exploitation is not confirmed. The NVD record status is "Received", published 2026-10-14.
What's Vulnerable
- Vendor: printcart
- Product: Printcart Store – Web to Print Product Designer for WooCommerce (also called PCDesigner / NB Designer)
- Affected versions: all versions up to and including 2.9.1
Patch Status
The references include a WordPress plugin changeset (3716244) that modifies includes/class.nbdesigner.php, plus a diff between the 2.9.1 and 2.9.2 tags. The affected range ends at 2.9.1, so sites should update to version 2.9.2 or later and confirm the fix against the vendor changeset. There is no CISA KEV required action because the CVE is not listed in KEV.
If you cannot update right away, check wp-content/uploads/nbdesigner/temp/ for unexpected .php files.