External risk intelligence

Printcart Store WooCommerce Plugin Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-93388

The vulnerability exists in a WooCommerce plugin, which is a web-based e-commerce application. Such plugins are designed to be public-facing to facilitate customer interactions, and the vulnerable AJAX action is explicitly registered for unauthenticated, internet-accessible requests.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WooCommerce plugin affecting how images are handled, potentially allowing unauthorized users to execute code on servers running specific versions of the software. This issue stems from a flaw in the plugin's image upload functionality, which, under certain conditions, can be exploited to upload and run malicious files.

Allows unauthorized code execution.
High risk for e-commerce platforms.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload a malicious PHP file to a web-accessible directory by tricking the WooCommerce plugin into fetching a file from a supplied URL. This can be achieved through a specific AJAX action that improperly handles filenames from Google Drive links. Once the PHP file is uploaded, the attacker can then execute arbitrary code on the server.

No authentication required.
File upload via AJAX action.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

The Printcart Store plugin for WooCommerce could allow unauthenticated attackers to execute arbitrary code on the server. This occurs when an attacker uploads a malicious file via the Google Drive integration, which bypasses security checks and saves the file to a web-accessible directory.

Server code execution is at risk.
Attacker uploads malicious file.
Compromise of the e-commerce site.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Printcart Store plugin for WooCommerce enables unauthenticated attackers to execute arbitrary code on the server. Technical leaders should direct infrastructure and application owners to confirm the presence and reachability of this plugin, assess business criticality, and then plan remediation.

Application and infrastructure teams own resolution.
Verify plugin presence and external reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Printcart Store plugin for WooCommerce?

The Printcart Store (or PCDesigner / NB Designer) plugin is an add-on for WooCommerce, a widely used e-commerce platform for WordPress. It provides design customization features, allowing customers to create or personalize product designs. Because it integrates directly into the store's web architecture, it handles various media tasks—such as image processing—to support the customer design workflow.

What does CWE-434 mean regarding CVE-2026-93388?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the plugin fails to properly validate the types of files being uploaded to the server. Because the software does not strictly enforce file extension or content checks for certain operations, it allows a user to upload a file that the web server might interpret and execute as code, rather than simply storing it as a harmless image.

How does an attacker trigger this vulnerability?

An attacker exploits the plugin by calling a specific AJAX action designed to fetch images from Google Drive. The vulnerability is triggered when they supply a crafted filename in the request that bypasses the plugin's standard file-type filters. Notably, the vulnerability is not triggered by normal, authorized user uploads through the standard store interface; it requires the deliberate use of this specific, misconfigured backend AJAX action.

Why should I care about CVE-2026-93388 in my environment?

Halo Surface Signal notes that WooCommerce plugins are typically internet-facing to support customer shopping activity. Because this specific AJAX action is registered for unauthenticated access, any external user can reach the vulnerable code. If your store is public, the risk is elevated because the flaw does not require a customer account or administrative credentials to initiate the file upload process.

What should I do first to address this issue?

Begin by auditing your WordPress environment to verify if the Printcart Store or NB Designer plugin is installed and active. If found, confirm its reachability and assess the business impact of the affected e-commerce site. Once identified, prioritize updating the plugin to a patched version that resolves the file validation bypass, ensuring your team coordinates this update to maintain site stability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.