CVE-2026-93388

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-434

Impact

Unauthenticated remote attackers can execute arbitrary code on the server by uploading malicious PHP files. They only need network access to hit the WordPress AJAX endpoints with their own Google Drive source file.

Root cause

The nbdesigner_copy_image_from_url AJAX action uses raw user input from gapi[name] for the destination filename in a web-accessible upload directory, bypassing file extension allow-lists.

Affected systems

Printcart Store (PCDesigner / NB Designer / printcart-integration) plugin for WooCommerce versions up to and including 2.9.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the plugin to version 2.9.2 or later. If patching immediately is not possible, disable the plugin or block direct PHP execution inside wp-content/uploads/nbdesigner/ via web server rules.

shell

$ wp plugin update printcart-integration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-93388