Printcart Store WooCommerce plugin: Unauthenticated file upload leading to RCE
Summary
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce and WordPress, versions up to and including 2.9.1, allows unauthenticated users to upload arbitrary files via the nbdesigner_copy_image_from_url AJAX action. The Google Drive branch writes the attacker-supplied file name without the image extension allow-list, so a PHP file can be placed in a web-accessible directory and executed. The required nonce is available to anonymous visitors, so no login is needed. An attacker could fully compromise the web server and access customer or payment data.
Affected
- Printcart Store (PCDesigner / NB Designer) plugin for WordPress (slug printcart-integration), versions 0 to 2.9.1 inclusive
Fixed in
- Version 2.9.2 or later (per the WordPress changeset and secondary sources; vendor advisory not verified)
Workaround
- Deactivate or remove the plugin if it cannot be updated.
- Block or restrict access to the nbdesigner_copy_image_from_url AJAX action, for example with a WAF rule.
- Block execution of PHP files in wp-content/uploads/.
- Check wp-content/uploads/nbdesigner/temp/ for unexpected PHP files and check gapi[name] parameters for .php, .phtml or .phar; this may break legitimate plugin functionality.
Exploitation
- No public proof of concept confirmed at this time.
- Not listed in the CISA KEV catalog as of the research date (not verified on the CISA site).
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
- Whether attacks have occurred in the wild is unknown.
Our recommendation
- Check whether the plugin is installed and which version runs, especially on WordPress/WooCommerce sites.
- Update to version 2.9.2 or later immediately.
- If patching is not possible, apply the workarounds above.
- Inspect the uploads directory, especially nbdesigner/temp, for webshells and unexpected PHP files, and review the web server logs for requests to the AJAX action.
- Reset credentials and review customer data access if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- WordPress changeset 3716244 (plugin trunk) plugins.trac.wordpress.org
- WordPress Trac comparison tags 2.9.1 to 2.9.2 plugins.trac.wordpress.org
- Ionix threat center CVE-2026-93388 www.ionix.io
- WordPress plugin page Printcart Store en-au.wordpress.org
- VULNCHECK/VulnRichment record CVE-2026-93388 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:06.
Original description (NVD)
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.
NVD references (3)
- https://plugins.trac.wordpress.org/changeset/3716244/printcart-integration/trunk/includes/class.nbdesigner.php
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3716244%40printcart-integration%2Ftags%2F2.9.2&old…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.