CVE-2026-19803

Overview

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

Description

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.

Impact

Confidentiality: attackers can read sensitive site files and data. Integrity: attackers can modify or delete files, inject malicious code. Availability: malicious code may crash or deface the site. Defenders: site administrators, developers, and security teams are directly impacted.

Remediation

1. Update the plugin to the latest version (>=2.13.3) which removes the vulnerable handler. 2. If an update is not immediately possible, disable the Advanced Upload Popup by setting the "nbdesigner_upload_popup_style" option to a value other than "a". 3. Remove or restrict the public "save-design" nonce from the frontend. 4. Patch the code to validate and normalize file paths, strip any "../" sequences, enforce authentication for file uploads, and restrict uploads to image MIME types only. 5. Implement file type and size checks on the server side before writing files.

Risk context

Severity critical with a CVSS v3 score of 9.8 and no EPSS data available. The vulnerability is highly exploitable and should be addressed immediately to prevent potential remote code execution.

Affected products

• Printcart Store – Web to Print Product Designer for WooCommerce
• WordPress