CVE-2026-93388: CWE-434 Unrestricted Upload of File with Dangerous Type in printcart Printcart Store – Web to Print Product Designer for WooCommerce

CVE-2026-93388 is an unauthenticated arbitrary file upload vulnerability in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, affecting all versions up to and including 2.9.1. The vulnerability arises because the nbdesigner_copy_image_from_url AJAX action is accessible to unauthenticated users (registered via wp_ajax_nopriv_) and reconstructs the destination filename from an attacker-controlled parameter (gapi[name]) without enforcing the usual image file type allow-list. This allows attackers to upload a .php file to a web-accessible directory (wp-content/uploads/nbdesigner/temp/), enabling remote code execution by supplying a malicious Google Drive file and OAuth token. The save-design nonce required for the operation is obtainable by anonymous users, removing barriers to exploitation.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with a high severity rating (CVSS 9.8).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX endpoint if possible, and monitor for suspicious file uploads in the wp-content/uploads/nbdesigner/temp/ directory. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for an official patch.