Printcart Store Plugin up to 2.9.1 on WordPress Google Drive Image Copy temp nbdesigner_copy_image_from_url name unrestricted upload

Summaryinfo

A vulnerability was found in Printcart Store Plugin up to 2.9.1. It has been declared as critical. This affects the function nbdesigner_copy_image_from_url of the file wp-content/uploads/nbdesigner/temp/ of the component Google Drive Image Copy. Such manipulation of the argument Name leads to unrestricted upload. This vulnerability is referenced as CVE-2026-93388. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Printcart Store Plugin up to 2.9.1. Affected by this issue is the function nbdesigner_copy_image_from_url of the file wp-content/uploads/nbdesigner/temp/ of the component Google Drive Image Copy. The manipulation of the argument name with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.

The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-93388 since 09/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/14/2026). This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• Printcart

Name

• Store Plugin

Version

• 2.9.0
• 2.9.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion