CVE-2026-93388: Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers (wpajaxnopriv), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbdcheckuseloggedin endpoint, so it presents no barrier.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No WordPress account, prior privileges, or user interaction are required.
What does an attacker need to provide?
The attacker needs control of a Google Drive-hosted file and an OAuth token used as the content source. They can supply a filename through the gapi[name] parameter that ends in .php, causing the fetched content to be written into the plugin's web-accessible temporary upload directory.
Does the save-design nonce prevent exploitation?
No. Anonymous callers can obtain the required save-design nonce through the nbd_check_use_logged_in endpoint, so the nonce does not restrict unauthenticated exploitation.
How can I check for possible exploitation?
Review wp-content/uploads/nbdesigner/temp/ for unexpected PHP files or other suspicious uploads. Because this directory is web-accessible and PHP-executing, investigate any unrecognized files there as potential web shells or attacker payloads.
Which versions are affected?
All Printcart PCDesigner versions through 2.9.1 are affected. The provided change history indicates a fix was introduced in version 2.9.2.