{"id":"CVE-2026-19803","kind":"vulnerability","aliases":["CVE-2026-19803"],"related":[],"title":"Printcart WooCommerce plugin: unauthenticated file upload leads to remote code execution","description":"The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.","summary":"The Printcart Web to Print Product Designer plugin for WordPress and WooCommerce lets an anonymous visitor write attacker-supplied PHP files to arbitrary server paths through its nbu_crop_image handler. Once the written file is requested, the attacker runs code on the web server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","printcart","self-hosted","woocommerce","wordpress"],"not_affected_if":["default-config","plugin-not-installed"],"how_to_check":"- Check whether the plugin is installed and its version is `2.13.2` or lower in the WordPress plugin list or the plugin's main file header.\n- Check whether the site option `nbdesigner_upload_popup_style` is set to `a` (Advanced Upload Popup).\n- Look for unexpected `.php` files in the uploads directory and other writable locations.","fix":"- Printcart Store plugin: versions above `2.13.2` are in scope; the sources do not name the fixed version.","status":"open","published_at":"2026-11-07T04:17:29+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","triaged_at":"2026-11-07T04:47:50+00:00","updated_at":"2026-11-07T04:47:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T04:47:50Z","model":"claude-haiku-5-5","output":{"fix":"- Printcart Store plugin: versions above `2.13.2` are in scope; the sources do not name the fixed version.","reach":"internet","title":"Printcart WooCommerce plugin: unauthenticated file upload leads to remote code execution","impact":"high","summary":"The Printcart Web to Print Product Designer plugin for WordPress and WooCommerce lets an anonymous visitor write attacker-supplied PHP files to arbitrary server paths through its nbu_crop_image handler. Once the written file is requested, the attacker runs code on the web server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","printcart","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attacker runs PHP code on the web server","analyst_note":"Find the fixed version of the Printcart plugin in the WordPress.org changelog or the Wordfence advisory for CVE-2026-19803.","how_to_check":"- Check whether the plugin is installed and its version is `2.13.2` or lower in the WordPress plugin list or the plugin's main file header.\n- Check whether the site option `nbdesigner_upload_popup_style` is set to `a` (Advanced Upload Popup).\n- Look for unexpected `.php` files in the uploads directory and other writable locations.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","plugin-not-installed"],"who_is_affected":"Sites running the Printcart Web to Print Product Designer plugin version 2.13.2 or lower on WordPress with WooCommerce are exposed only when the nbdesigner_upload_popup_style option is set to a. Sites that keep the default upload popup style, or that have the plugin removed, are not affected by this path. The nonce that gates the handler is printed on a public page, so no account is needed once the option is active.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000803,"input_tokens":4545,"output_tokens":698,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-19803':14A,17A '-2026':13A,16A '2.13.2':97C 'accept':108C 'activ':255C 'advanc':211C 'ajax':106C 'anonym':39B,249C 'arbitrari':48B,87C,176C 'attack':43B,64B,150C,167C,171C 'attacker-control':149C,170C 'attacker-suppli':42B 'base':126C 'call':156C 'caus':215C 'code':10A,66B,185C 'concaten':122C 'configur':253C 'content':174C 'control':151C,172C 'convert':118C 'crop':54B,104C 'cve':12A,15A 'deriv':135C 'design':31B,78C,229C,240C 'directori':127C,139C,181C 'due':100C 'execut':11A,186C 'exploit':198C 'extens':143C 'file':5A,46B,60B,88C,142C,190C,241C 'frontend':237C 'fulli':235C 'handler':56B,107C,217C 'host':22B 'howev':224C 'imag':55B,105C 'includ':96C 'invok':160C 'io':117C 'lead':7A 'let':37B 'locat':177C 'make':162C,243C 'nbdesign':116C,201C 'nbu':53B,103C 'nonc':230C 'normal':129C 'obtain':246C 'onto':123C 'option':206C 'output':138C,141C 'outsid':178C 'packag':18B 'page':242C 'paramet':114C 'path':50B,121C,152C 'pathinfo':145C 'php':45B,173C 'plugin':3A,32B,81C 'popup':203C,213C 'possibl':164C 'print':29B,76C,232C 'printcart':1A,19B,26B,72C 'product':30B,77C 'public':236C 'regist':220C 'remot':9A,184C 'request':62B,193C,223C 'requir':226C 'result':182C 'run':65B 'save':228C 'save-design':227C 'self':21B 'self-host':20B 'sequenc':132C 'server':49B,70B 'set':208C 'site':205C 'store':73C 'strip':131C 'stripimag':155C 'style':204C 'subsequ':192C 'suppli':44B,112C 'trivial':245C 'unauthent':4A,166C,222C 'upload':6A,89C,125C,180C,202C,212C,239C 'upload-design-fil':238C 'url':113C,119C 'user':111C 'user-suppli':110C 'version':92C 'via':144C 'visitor':40B,250C 'vulner':85C,195C 'web':27B,69B,74C 'without':128C 'woocommerc':2A,23B,36B,80C 'wordpress':24B,34B,83C 'write':41B,169C 'writeimag':158C 'written':59B,189C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Printcart Web to Print Product Designer plugin version 2.13.2 or lower on WordPress with WooCommerce are exposed only when the nbdesigner_upload_popup_style option is set to a. Sites that keep the default upload popup style, or that have the plugin removed, are not affected by this path. The nonce that gates the handler is printed on a public page, so no account is needed once the option is active.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","printcart","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-19803':14A,17A '-2026':13A,16A 'code':10A 'cve':12A,15A 'execut':11A 'file':5A 'lead':7A 'plugin':3A 'printcart':1A 'remot':9A 'unauthent':4A 'upload':6A 'woocommerc':2A","search_b":"'anonym':39B 'arbitrari':48B 'attack':43B,64B 'attacker-suppli':42B 'code':66B 'crop':54B 'design':31B 'file':46B,60B 'handler':56B 'host':22B 'imag':55B 'let':37B 'nbu':53B 'packag':18B 'path':50B 'php':45B 'plugin':32B 'print':29B 'printcart':19B,26B 'product':30B 'request':62B 'run':65B 'self':21B 'self-host':20B 'server':49B,70B 'suppli':44B 'visitor':40B 'web':27B,69B 'woocommerc':23B,36B 'wordpress':24B,34B 'write':41B 'written':59B","search_c":"'2.13.2':97C 'accept':108C 'activ':255C 'advanc':211C 'ajax':106C 'anonym':249C 'arbitrari':87C,176C 'attack':150C,167C,171C 'attacker-control':149C,170C 'base':126C 'call':156C 'caus':215C 'code':185C 'concaten':122C 'configur':253C 'content':174C 'control':151C,172C 'convert':118C 'crop':104C 'deriv':135C 'design':78C,229C,240C 'directori':127C,139C,181C 'due':100C 'execut':186C 'exploit':198C 'extens':143C 'file':88C,142C,190C,241C 'frontend':237C 'fulli':235C 'handler':107C,217C 'howev':224C 'imag':105C 'includ':96C 'invok':160C 'io':117C 'locat':177C 'make':162C,243C 'nbdesign':116C,201C 'nbu':103C 'nonc':230C 'normal':129C 'obtain':246C 'onto':123C 'option':206C 'output':138C,141C 'outsid':178C 'page':242C 'paramet':114C 'path':121C,152C 'pathinfo':145C 'php':173C 'plugin':81C 'popup':203C,213C 'possibl':164C 'print':76C,232C 'printcart':72C 'product':77C 'public':236C 'regist':220C 'remot':184C 'request':193C,223C 'requir':226C 'result':182C 'save':228C 'save-design':227C 'sequenc':132C 'set':208C 'site':205C 'store':73C 'strip':131C 'stripimag':155C 'style':204C 'subsequ':192C 'suppli':112C 'trivial':245C 'unauthent':166C,222C 'upload':89C,125C,180C,202C,212C,239C 'upload-design-fil':238C 'url':113C,119C 'user':111C 'user-suppli':110C 'version':92C 'via':144C 'visitor':250C 'vulner':85C,195C 'web':74C 'without':128C 'woocommerc':80C 'wordpress':83C 'write':169C 'writeimag':158C 'written':189C","first_public_at":"2026-11-07T04:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19803","severity":null,"published_at":"2026-11-07T04:17:29+00:00","modified_at":"2026-11-07T04:17:29+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","fetched_at":"2026-11-07T04:45:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}