Key points
- The flaw is tracked as CVE-2026-93388 and carries a CVSS score of 9.8.
- It enables unauthenticated arbitrary file upload leading to remote code execution.
- The vulnerability affects all versions up to and including 2.9.1.
The Printcart Store plugin for WooCommerce, also known as PCDesigner or NB Designer, contains a critical security flaw affecting all versions through 2.9.1. According to the National Vulnerability Database record for CVE-2026-93388, this issue allows unauthenticated attackers to achieve remote code execution. The vulnerability stems from how the plugin handles file uploads via a specific AJAX action. The source material does not confirm whether a patch or fix is available for these affected versions.
In plain English
Attackers can upload malicious files to servers running this plugin without needing a username or password. The plugin uses a feature to copy images from Google Drive. In this process, it takes the filename directly from the attacker’s request. This bypasses the usual safety check that restricts uploads to image formats like JPG or PNG. As a result, an attacker can upload a PHP script. The script is saved in a web-accessible folder where the server executes it. This gives the attacker full control over the server.
The background
The specific vulnerability exists in the `nbdesigner_copy_image_from_url` AJAX action. According to the NVD description, this action is registered for logged-out users. When using the Google Drive branch, the plugin rebuilds the destination filename from the `gapi[name]` parameter. This parameter is supplied raw by the attacker. The other branch of the code applies an allow-list for image extensions, but this branch does not. The fetched bytes are written to `wp-content/uploads/nbdesigner/temp/`. This directory is web-accessible and executes PHP code.
What changes now
Teams must assess their exposure to this unauthenticated remote code execution flaw immediately. The vulnerability allows attackers to supply their own Google Drive file and OAuth token as the content source. The required save-design nonce is provided to anonymous callers by the `nbd_check_use_logged_in` endpoint. This means the nonce presents no barrier to exploitation. The weakness is classified as CWE-434, which relates to unrestricted upload of executable code. Organizations using WooCommerce with this plugin are at significant risk.
Who needs to act first
Security operations teams should prioritize systems exposed to the public internet. Check whether the Printcart Store plugin is installed on any production environments. If the plugin is active, isolate those servers from untrusted networks if possible. Verify if any custom configurations restrict access to the upload endpoints. Teams usually begin by identifying all instances of the affected software. Back up database and file systems before making any changes. Monitor logs for unusual file creation or access patterns in upload directories.
Background: Unauthenticated remote code execution
Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.
Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
What to do and how to stay safe: Printcart Store
- Identify all WooCommerce installations running Printcart Store version 2.9.1 or earlier.
- Restrict access to the plugin’s AJAX endpoints using web application firewalls or network rules.
- Monitor server logs for attempts to upload files with executable extensions like .php.
- Prepare to disable the plugin temporarily if no vendor update becomes available soon.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Printcart Store plugin are affected?
All versions up to and including 2.9.1 are vulnerable to this remote code execution flaw.
Is there a patch available for CVE-2026-93388?
The source material does not state whether a fix or update exists for this vulnerability.
Does an attacker need to log in to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to execute code without logging in.
