Unauthenticated File Upload Vulnerability in Printcart Store Plugin for WooCommerce

CVE-2026-93388

What is CVE-2026-93388?

The Printcart Store plugin for WooCommerce has a vulnerability that allows unauthenticated users to upload arbitrary files, potentially leading to remote code execution. The issue arises from the nbdesigner_copy_image_from_url AJAX action, which is accessible to logged-out users. Attackers can exploit this to write an executable PHP file to a web-accessible directory. This is done by manipulating the gapi[name] parameter to bypass the image file type restrictions. With proper crafting of a Google Drive file and OAuth token, malicious actors can execute custom code on the server, posing a significant risk to website security.

References