Printcart Store v2.9.1 Flaw: Google Drive Endpoint Lets Attackers Run Code Without Login

The Printcart Store plugin for WooCommerce contains a critical security flaw that enables unauthenticated remote code execution. This vulnerability, tracked as CVE-2026-93388, affects all plugin versions up to and including 2.9.1.

What happened

The flaw resides in the `nbdesigner_copy_image_from_url` AJAX action, which is registered for logged-out users via the `wp_ajax_nopriv_` handler. According to the National Vulnerability Database record, this action includes a branch for processing files from Google Drive. This specific branch constructs the destination filename using the raw, attacker-supplied `gapi[name]` parameter.

This construction method bypasses the allow-list for jpg, jpeg, png, and gif files that protects other branches of the code. The fetched bytes are written directly to a web-accessible directory at `wp-content/uploads/nbdesigner/temp/`. As a result, an unauthenticated attacker can write a PHP file to a location where the server executes it.

The attack requires the attacker to supply their own Google Drive file and OAuth token as the content source. The necessary save-design nonce, which might otherwise block the request, is provided to anonymous callers by the `nbd_check_use_logged_in` endpoint. This means the nonce presents no barrier to exploitation.

Why it matters

The vulnerability is rated 9.8 on the CVSS scale, which classifies it as critical. The weakness is categorized under CWE-434, indicating an arbitrary file upload issue. Because the flaw allows code execution without any user interaction or authentication, it poses a severe risk to any WooCommerce site running the affected plugin versions.

Attackers can fully compromise the server by uploading malicious scripts. The exposure is significant because the vulnerable endpoint is accessible to anyone on the internet. The source material does not state whether a fix or patch is available, leaving the status of remediation unconfirmed.

What to watch

• Monitor vendor announcements for a patched version of the Printcart Store plugin.
• Check server logs for unusual requests to the `nbdesigner_copy_image_from_url` endpoint.
• Look for new files in the `wp-content/uploads/nbdesigner/temp/` directory.
• Verify that no unauthorized PHP files exist in web-accessible upload directories.

Who needs to act first

Teams should immediately identify all WooCommerce sites running the Printcart Store plugin. Prioritize systems that are publicly accessible and handle customer data. If no patch is available, consider temporarily disabling the plugin or restricting access to the affected endpoints via web server rules. Isolate affected systems from the public internet if possible. Test any mitigation steps in a staging environment before applying them to production. Ensure backups are recent and verified before making changes. Communicate the risk to stakeholders and prepare an incident response plan in case exploitation is detected.

Background: OAuth

OAuth is a protocol for granting limited access to resources without sharing credentials. SSO is a pattern that lets users access multiple apps with one login. They solve different problems: OAuth handles authorization, while SSO handles authentication and session management.

Read the full guide: OAuth vs SSO: How to Choose the Right Identity Protocol

What to do and how to stay safe: Printcart Store

• Audit your WordPress plugins to confirm if Printcart Store version 2.9.1 or earlier is installed.
• Restrict access to the `wp-admin` and AJAX endpoints using firewall rules or web application firewalls.
• Monitor file integrity in upload directories to detect unauthorized script creation.
• Prepare to disable the plugin immediately if a patch is not provided promptly.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Printcart Store are affected by CVE-2026-93388?

All versions up to and including 2.9.1 are vulnerable to this critical remote code execution flaw.

Is authentication required to exploit this vulnerability?

No, the vulnerability allows unauthenticated attackers to execute code remotely without logging in.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-93388 with a CVSS score of 9.8, which is critical.