CVE-2026-93388

Summary

The Printcart Store plugin allows unauthenticated attackers to upload arbitrary files, including PHP code, to a web-accessible directory via a Google Drive integration flaw. This leads to remote code execution on the server without requiring authentication or valid session tokens.

Exploitability

Exploitation is straightforward with no prerequisites beyond access to the vulnerable WordPress site, as the plugin exposes an AJAX endpoint for unauthenticated users and provides a nonce that allows anonymous callers to save designs.

Blast radius

The vulnerability affects all versions up to and including 2.9.1, potentially impacting a large number of WooCommerce stores using this plugin, with critical impact from arbitrary code execution on the server.

Detection

Monitor for unusual file uploads in wp-content/uploads/nbdesigner/temp/ directory, particularly PHP files with attacker-controlled names, and watch for requests to wp-admin/admin-ajax.php with action=nbdesigner_copy_image_from_url and gapi[name] parameter containing suspicious filenames.

Prioritized remediation

Upgrade to version 2.9.2 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.