{"schemaVersion":1,"id":"CVE-2026-93388","requestedId":"CVE-2026-93388","aliases":[],"status":"published","rawState":"Deferred","rawSeverityStatus":"Deferred","duplicateOf":null,"indexable":true,"title":null,"description":"The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.","dates":{"published":"2026-10-14T01:27:13.964Z","modified":"2026-10-14T17:55:31.470Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"cve.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"cve.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"nvd","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00854,"percentile":0.57406,"severity":"low","asOf":"2026-10-14T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.00854,"percentile":0.57406}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.00854,"percentile":0.57406}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","evidence":[]},"exploits":[],"exploitCount":0,"exploitSources":[],"weaknesses":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/434.html","capec":[{"id":"CAPEC-1","name":"Accessing Functionality Not Properly Constrained by ACLs","url":"https://capec.mitre.org/data/definitions/1.html"}],"techniques":[{"id":"T1574.010","name":"Services File Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/010/","tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}]}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}],"ttp":{"capecs":[{"id":"CAPEC-1","name":"Accessing Functionality Not Properly Constrained by ACLs","url":"https://capec.mitre.org/data/definitions/1.html","weaknessIds":["CWE-434"],"techniqueIds":["T1574.010"]}],"techniques":[{"id":"T1574.010","name":"Services File Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/010/","weaknessIds":["CWE-434"],"capecIds":["CAPEC-1"],"tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}],"countermeasuresByTactic":[{"tactic":"Harden","items":[{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"}]},{"tactic":"Detect","items":[{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"}]},{"tactic":"Restore","items":[{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"}]},{"tactic":"Model","items":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}]},"affected":[{"vendor":"printcart","product":"printcart store – web to print product designer for woocommerce","name":"Printcart Store – Web to Print Product Designer for WooCommerce","label":"printcart store – web to print product designer for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≤ 2.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.9.1","eol":null},{"vendor":"wordpress","product":"printcart-integration","name":"Printcart Store – Web to Print Product Designer for WooCommerce","label":"printcart-integration","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≤ 2.9.1 (fixed in 2.9.2)","noFixRecorded":false,"fixedIn":"2.9.2"}],"versionsText":"≤ 2.9.1 (fixed in 2.9.2)","eol":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=cve","hostname":"www.wordfence.com","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3716244%40printcart-integration%2Ftags%2F2.9.2&old=3715643%40printcart-integration%2Ftags%2F2.9.1","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://plugins.trac.wordpress.org/changeset/3716244/printcart-integration/trunk/includes/class.nbdesigner.php","label":"plugins.trac.wordpress.org/changeset/…","hostname":"plugins.trac.wordpress.org","tags":[],"sources":["cve.org","nvd"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae","label":"www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae","hostname":"www.wordfence.com","tags":["Vendor Advisory"],"sources":["wordfence"]}],"droppedReferenceCount":0,"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-14T01:27:13.964Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-14T17:55:31.470Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"default","profileName":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10},"appliedRules":["high-cvss-alone"]},"warnings":[],"meta":{"dataAsOf":"2026-10-14T23:30:48.628Z","stale":false,"partial":false}}