Printcart Store: Arbitrary File Upload Bug Lets Attackers Write Executables to WooCommerce Servers Without Credentials
Attackers can write executable files to WooCommerce servers without credentials in Printcart Store versions up to 2.9.1.
Key points
- The vulnerability allows unauthenticated remote code execution via arbitrary file upload.
- It affects Printcart Store plugin versions 2.9.1 and earlier for WooCommerce.
- The flaw enables attackers to bypass file extension filters using a Google Drive branch.
Unauthenticated attackers can execute arbitrary code on servers running the Printcart Store plugin for WooCommerce by uploading malicious files. This capability exists in all versions up to and including 2.9.1. The vulnerability allows remote actors to place executable content in web-accessible directories without needing valid user credentials or session tokens.
How it unfolded
- Attackers target the nbdesigner_copy_image_from_url AJAX action registered for logged-out users.
- They supply a Google Drive file and OAuth token to trigger the specific upload branch.
- The plugin writes the fetched bytes to a web-served directory using an attacker-controlled filename.
Who is affected
The Printcart Store plugin, also known as PCDesigner or NB Designer, is affected in versions through 2.9.1. Any WooCommerce site using this product faces exposure to unauthenticated remote code execution. The vulnerability is rated CVSS 9.8 critical by the National Vulnerability Database. It relies on the ability to write files with arbitrary extensions to a location that executes PHP code.
The fix
The source material does not mention a patch, fix, or update for this vulnerability. No information regarding temporary workarounds is provided in the available records. Site administrators should monitor for future announcements from the vendor.
What made it possible
This incident illustrates the risk of inconsistent input validation across different code paths. When applications process data from multiple sources, such as local uploads and external APIs, each path must enforce identical security controls. Teams usually review all file handling routines to ensure that allow-lists apply universally. Check whether any endpoint reconstructs filenames from external parameters without re-verifying extensions. This stage of an intrusion serves as the initial foothold, allowing attackers to establish persistent control over the server environment.
What to do and how to stay safe: Printcart Store
- Audit all AJAX actions registered for non-authenticated users to verify they enforce strict input validation.
- Ensure file upload endpoints validate extensions on the server side, regardless of the source of the content.
- Monitor web server logs for unusual file creation patterns in upload directories, especially for executable types.
- Review access controls for temporary directories to prevent direct execution of uploaded content.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Printcart Store are vulnerable?
All versions up to and including 2.9.1 are affected by this unauthenticated remote code execution flaw.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to execute code without valid login credentials.
What is the CVSS score for this issue?
The National Vulnerability Database rates CVE-2026-93388 as CVSS 9.8 critical.
