Arbitrary File Upload Vulnerability in Printcart Store Plugin for WordPress

CVE-2026-19803

What is CVE-2026-19803?

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is affected by an Arbitrary File Upload vulnerability that allows unauthenticated attackers to upload malicious PHP files to arbitrary locations outside the uploads directory. This occurs because the nbu_crop_image AJAX handler improperly handles user input, concatenating unvalidated parameters to the uploads base directory. Additionally, the lack of file path normalization and the ability to derive output directory and file extensions from an attacker-controlled path further compromise security. Specifically, when the nbdesigner_upload_popup_style is set to 'a' (Advanced Upload Popup), the plugin allows unauthenticated requests, making it trivial for attackers to exploit this vulnerability and execute arbitrary code on affected sites.

References