External risk intelligence

Printcart Store for WooCommerce Arbitrary File Upload Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19803

The vulnerability exists in a WordPress plugin designed for public-facing e-commerce functionality. The affected component is reachable via the public frontend of the website, and the specific configuration required for exploitation is intended for public user interaction. As a web-based plugin component directly exposed to anonymous visitors, it is by design a public-facing internet service.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a WordPress plugin that allows users to customize products for e-commerce. While specific conditions are required for exploitation, the flaw could allow attackers to upload malicious files to a website's server, potentially leading to unauthorized code execution. The main concern is confirming relevance and exposure.

Allows attackers to upload files to websites.
Enables unauthorized code execution on servers.
Confirm relevance and exposure of the plugin.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by first ensuring the plugin's "Advanced Upload Popup" setting is enabled, which exposes a file upload handler to unauthenticated users. An anonymous visitor can then obtain a required security token from the public page and send a crafted request to the vulnerable AJAX handler. This request manipulates a URL parameter to write malicious PHP code to an arbitrary location on the server, enabling remote code execution when that file is accessed.

Unauthenticated access to a public page.
Specially crafted file upload request.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When the Printcart Store – Web to Print Product Designer for WooCommerce plugin is configured with the advanced upload popup, unauthenticated attackers could upload arbitrary PHP content to the server. This could lead to remote code execution when the uploaded file is accessed. The required nonce for this action is present on a publicly accessible page, making it easily obtainable by anonymous visitors.

System files could be overwritten.
Attackers could upload malicious PHP files.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Printcart Store plugin for WooCommerce on WordPress is vulnerable to remote code execution. This issue is likely to impact teams responsible for maintaining the WordPress application and its plugins, potentially including the web development team, platform operations, or the specific application owner. The first practical step is to determine if the `nbdesigner_upload_popup_style` option is set to `a` (Advanced Upload Popup) and if the plugin is configured in a way that exposes the vulnerable AJAX handler to unauthenticated users, then to identify accountable owners for the WordPress instances running this plugin and assess business criticality.

WordPress and plugin owners must act.
Verify the vulnerable option and configuration.
Plan risk-based remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Printcart Store – Web to Print Product Designer for WooCommerce plugin?

It is a WordPress extension that enables customers to personalize items directly on an e-commerce site. By integrating design tools into the store, it allows users to create custom visuals for products before purchase. Because it operates within the e-commerce workflow, it requires direct interaction with site visitors, making it a functional component of the storefront's public-facing architecture.

How does CVE-2026-19803 cause a security weakness?

This vulnerability is classified as Improper Neutralization of Input During Web Page Generation, or CWE-94. It occurs because the plugin's image handling process fails to sanitize user-provided file paths. By including special directory navigation characters, an attacker can trick the server into writing malicious PHP code to unintended folders, effectively allowing them to bypass file upload restrictions and execute their own code on the host system.

Do I need to be authenticated for this to be triggered?

No, authentication is not required for the attack to succeed, provided the site uses the 'Advanced Upload Popup' setting. While the process requires a security nonce, this token is publicly printed on the design upload page. Therefore, an anonymous visitor can simply retrieve the token from the site's frontend and use it to complete the request. If the advanced popup style is disabled, the specific vulnerable handler remains inactive.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is very likely a public-facing risk because the plugin is designed for e-commerce, which by nature exposes functionality to anonymous users. Since the vulnerable component is part of the frontend web experience, any WordPress site running this plugin with the specified configuration is essentially offering a path for internet-based actors to interact with the server's file system.

When should I take action for this vulnerability?

You should investigate immediately if you use this plugin. Start by checking your WordPress settings to see if the 'Advanced Upload Popup' option is set to 'a'. If it is, consider changing the configuration or temporarily disabling the feature until a patch is applied. Identify the team responsible for your site's plugin management to ensure they are aware of the need to verify your current settings and plan necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.