9.8 CVSS: Anonymous Attackers Achieve RCE on WooCommerce via Printcart Store Google Drive File Upload Flaw

Security operations teams should immediately verify if their WooCommerce environments run Printcart Store versions through 2.9.1. The plugin contains a critical remote code execution flaw that allows unauthenticated attackers to upload executable files. This vulnerability is rated CVSS 9.8 according to the National Vulnerability Database record for CVE-2026-93388.

How does the attack work?

The vulnerability exists in the nbdesigner_copy_image_from_url AJAX action, which is registered for logged-out users via wp_ajax_nopriv_. When an attacker triggers the Google Drive branch of this action, the plugin rebuilds the destination filename using the raw, attacker-supplied gapi[name] parameter. This process bypasses the jpg/jpeg/png/gif allow-list that applies to other branches of the code.

The fetched bytes are written to wp-content/uploads/nbdesigner/temp/, a web-accessible directory. By supplying their own Google Drive file and OAuth token as the content source, attackers can write a .php file to this location. This allows them to execute arbitrary code on the server without needing valid user credentials.

Why is authentication bypassed?

A typical WordPress AJAX action requires a nonce to prevent cross-site request forgery, but this endpoint does not enforce it effectively. The nbd_check_use_logged_in endpoint hands the required save-design nonce to anonymous callers. Consequently, this security token presents no barrier to unauthenticated attackers attempting to exploit the file upload mechanism.

As Firewall Scoop reported on 2026-10-14, Microsoft confirmed a heap-based buffer overflow in Windows Error Reporting that also allows remote code execution without authentication. While that flaw affected a different product, it highlights the broader trend of high-severity, unauthenticated execution risks across diverse software ecosystems.

What is the scope of exposure?

The flaw affects all versions of Printcart Store up to and including 2.9.1. The National Vulnerability Database classifies the weakness as CWE-434, which relates to unrestricted upload of a file with a dangerous type. The plugin, also known as PCDesigner or NB Designer, is designed for WooCommerce sites that offer web-to-print product design capabilities.

Our data desk analysis of public data shows that 829 new CVE records were published in the last 24 hours. Among these, 77 were rated critical with a CVSS score of 9.0 or higher. The Printcart Store flaw is among the highest-rated issues, alongside vulnerabilities in e107 and D-Link products.

Is a fix available?

The source material does not confirm that a patch or update has been released for Printcart Store. Teams should treat this as an active risk for any site running vulnerable versions. Without a confirmed fix, the only reliable mitigation is to disable or remove the plugin if business operations allow, or to isolate the affected web server from external access.

Detection notes

Security teams usually detect unauthenticated file uploads by monitoring web server access logs for requests to AJAX endpoints from unknown IP addresses. Look for unusual HTTP POST requests to the nbdesigner_copy_image_from_url action, especially those containing large payloads or binary data. Check for the creation of new files in the wp-content/uploads/nbdesigner/temp/ directory, particularly those with executable extensions like .php. If such activity is observed, immediately block the source IP at the firewall and isolate the web server to prevent further code execution. Review server process lists for unexpected PHP processes running from the upload directory.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Printcart Store

• Audit your WooCommerce plugins to identify if Printcart Store is installed and check if the version is 2.9.1 or earlier.
• Monitor web server logs for unauthorized access to the nbdesigner_copy_image_from_url AJAX endpoint from anonymous sources.
• Inspect the wp-content/uploads/nbdesigner/temp/ directory for any newly created files, especially those with executable extensions.
• Restrict access to the plugin's endpoints using a web application firewall or IP allow-listing until a vendor update is confirmed.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE ID is associated with this vulnerability?

The vulnerability is tracked as CVE-2026-93388 in the National Vulnerability Database.

What CVSS score is assigned to this flaw?

The National Vulnerability Database rates the severity of CVE-2026-93388 as 9.8, which is critical.

Does this vulnerability require attacker authentication?

No, the flaw allows unauthenticated attackers to execute code by bypassing authentication checks via the Google Drive upload branch.