VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

Printcart Store <= 2.13.2 — Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter

CVE-2026-19803Published · Updated

Action summary

Affected: ≤2.13.2Update to 2.13.3 or newer

All remediation steps
Watch plugin
Critical9.8CVSS 3.19.8EPSS1.0%CISA KEVNot listedAccessNo account needed
On this page4

Overview

Advisory ID
CVE-2026-19803
Affected
≤2.13.2
Fixed in
2.13.3
Required access
No account needed
Published
· updated
Credit
nudien
  1. Affected≤ 2.13.2
  2. Patched in2.13.3

Update to 2.13.3 or newer.

9.8
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:N Privileges required
None
UI:N User interaction
None
S:U Scope
Unchanged
C:H Confidentiality
High
I:H Integrity
High
A:H Availability
High

The Printcart Store web-to-print designer plugin for WooCommerce, up to and including version 2.13.2, contains a critical code injection issue in its nbu_crop_image AJAX handler. An attacker who never logs in can supply a crafted url value that escapes the uploads directory and causes PHP content to be written to a location of their choosing; requesting that file then executes the code. The vendor fixed the problem in version 2.13.3, and every site running an earlier release should update now.

Analysis from the vendor patch — not reproduced in the lab · reviewed by auto (§8.3a) · updated

Source description — Wordfence Intelligence, credited to nudien

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.

Not sure which version you run? Run a passive check — it reads public files only.

Technical analysis

The nbu_crop_image handler accepts a user-controlled url parameter and passes it to Nbdesigner_IO::convert_url_to_path(). That routine appends the supplied URL to the uploads base directory without normalizing the path or stripping traversal sequences, so the resulting path can land outside uploads. The destination directory and the output file extension are then both taken from that same attacker-controlled path through pathinfo(). The image data is written without any sanitization call, such as stripImage() before writeImage(), meaning non-image content including PHP code can be written to the resulting file.

Version 2.13.3 resolves the issue.

Remediation & mitigations

  1. Update the Printcart Store plugin to version 2.13.3 or later immediately.
  2. If you cannot patch right away and your site does not need the Advanced Upload Popup, change nbdesigner_upload_popup_style away from the a value so the handler is not reachable anonymously.
  3. Review the uploads directory and other writable locations for unexpected PHP files and remove anything you cannot attribute to normal site activity.
  4. Deactivate the plugin if no fixed version is available to you in your update channel.
  5. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Related CVEs

More vulnerabilities in Printcart Store – Web to Print Product Designer for WooCommerce
SeverityVulnerabilityCVEPublished
Critical9.8Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
≤2.9.1Update to 2.9.2
CVE-2026-93388
High7.5Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
≤2.8.5Update to 2.8.6
CVE-2026-14323
High7.5Unauthenticated Arbitrary File Read
≤2.5.2Update to 2.5.3
CVE-2025-15662
Critical9.1Unauthenticated Arbitrary File Deletion
≤2.5.2Update to 2.5.3
CVE-2026-9725
Medium5.3Directory Traversal to Unauthenticated Folder Content Disclosure
≤2.5.1Update to 2.5.2
CVE-2025-10268

Timeline

  1. CVE published

    Severity critical, CVSS 9.8

  2. Record last updated

  3. VulnCrest analysis published

Sources & licenses

Wordfence record
Vulnerability data
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVE® identifiers
Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
EPSS
Exploit Prediction Scoring System by FIRST.org.
VulnCrest content
Analysis, summary, remediation and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?