{"affected":[{"defaultStatus":"unaffected","product":"Printcart Store – Web to Print Product Designer for WooCommerce","source":"CNA: Wordfence","vendor":"printcart","versions":[{"lessThanOrEqual":"2.13.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-19803","cwes":["CWE-94"],"description":"The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.","epss":{"date":"2026-11-08","percentile":0.61837,"score":0.00962},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794164724958,"publishedAt":1794022084940,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2525ed97-b701-4f95-8d8c-202e816723c5?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L284"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L272"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class-util.php#L165"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L56"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class-util.php#L586"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3747660%40printcart-integration&new=3747660%40printcart-integration"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class-util.php#L165"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class-util.php#L586"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L272"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L284"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L56"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3747660%40printcart-integration&new=3747660%40printcart-integration"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2525ed97-b701-4f95-8d8c-202e816723c5?source=cve"}],"remediation":[],"revision":"f1d5be0bc6dcce489806ac2dd674bb32721609e25058e152254adbbc8c3edc42","sources":[{"modifiedAt":1794164724958,"name":"CNA: Wordfence","retrievedAt":1794168595478,"url":"https://www.cve.org/CVERecord?id=CVE-2026-19803"},{"modifiedAt":1794025049377,"name":"NVD","retrievedAt":1794032178661,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19803"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794168618001,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19803"}],"ssvc":{"assessedAt":1794163814405,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter","updatedAt":1794168618001}