CVE-2026-93388: Printcart Plugin Allows Code Execution Without Authentication
This text was generated using artificial intelligence (AI).CVE-2026-93388 affects the Printcart Store plugin for WooCommerce. All versions up to and including 2.9.1 are affected. The vulnerability allows unauthenticated attackers to upload arbitrary files and can lead to code execution on the server.
Wordfence rates the vulnerability with a CVSS score of 9.8 and assigns it to CWE-434. The patch is available with version 2.9.2.
The affected action nbdesigner_copy_image_from_url is registered for unauthenticated calls. In the Google Drive branch, the name of the target file is derived from the attacker-controlled parameter gapi[name] This bypasses the file type check intended for another processing branch.
The retrieved data is stored in the web-accessible directory wp-content/uploads/nbdesigner/temp/ Under these conditions, a PHP file can land in a directory where PHP is executed. Attackers can use their own Google Drive file and an OAuth token as content sources.
A nonce required for storing designs does not pose an obstacle according to Wordfence: the endpoint nbd_check_use_logged_in also outputs it to unauthenticated callers.
Impact and timeline
The vulnerability affects Printcart Store up to and including version 2.9.1. The patch was released on September 28, 2026; the CVE documentation followed on October 14, 2026. The vulnerability was discovered and reported by Osman Hussein.
For prioritization, three questions are particularly relevant:
Is Printcart Store in use on a WooCommerce instance?
Is the affected web application operated under a publicly accessible corporate domain?
Are there suspicious PHP files in the directory? wp-content/uploads/nbdesigner/temp/ Operators of publicly accessible WooCommerce shops within the EU that process personal data should observe the reporting obligation under Article 33 GDPR in case of successful exploitation: data protection authorities are generally to be informed within 72 hours. For operators in Germany and Austria subject to NIS-2 or the Austrian NISG, there is also an obligation to appropriately handle known vulnerabilities. Operators in Switzerland are subject to the revised Information Security Act (ISG) with a reporting obligation to BACS.
Betreiber öffentlich erreichbarer WooCommerce-Shops innerhalb der EU, die personenbezogene Daten verarbeiten, sollten im Fall einer erfolgreichen Ausnutzung die Meldepflicht nach Art. 33 DSGVO beachten: Datenschutzbehörden sind in der Regel innerhalb von 72 Stunden zu informieren. Für Betreiber in Deutschland und Österreich, die unter NIS-2 bzw. das österreichische NISG fallen, gilt darüber hinaus die Pflicht zur angemessenen Behandlung bekannt gewordener Schwachstellen. Betreiber in der Schweiz unterliegen dem revidierten Informationssicherheitsgesetz (ISG) mit Meldepflicht an das BACS.
Measures for Affected Installations
Update Plugin: Update Printcart Store to version 2.9.2 or higher.
Check Patch Status: Record installed versions and affected WooCommerce instances.
Examine Temporary Directory: Check the directory wp-content/uploads/nbdesigner/temp/ for suspicious PHP files.
Respond to Indicators of Compromise: Initiate the incident response process for anomalous files or other indications.
Block Script Execution in the Temporary Directory: The plugin patch adds server-side protection rules for the temporary directory; additional rules may be required for Nginx environments depending on server configuration - refer to the patch diff in the WordPress Plugin Repository for details.
Map Externally Accessible Web Applications
The Printcart Store plugin is used within a WordPress and WooCommerce web application under the domain of the operating company. The affected AJAX action is accessible without login, thus belonging to the externally accessible attack surface.
LocateRisk supports the visibility of publicly accessible systems and deployed software under company domains. This allows for WordPress and WooCommerce instances to be mapped for further technical examination and prioritizes the handling of exposed applications. The identification of a specifically vulnerable version, as well as patching, forensic examination, and incident response, remains with the respective teams.
Am I affected?
This affects Printcart Store in the versions mentioned above; the vulnerability has been fixed in 2.9.2. If you want to know whether Printcart Store is visible in your own externally accessible infrastructure, you can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
The vulnerability is rated with a CVSS score of 9.8 (Critical). The score reflects that an attack is possible without authentication, without user interaction, and over the network, and in the event of success, it allows complete control over the confidentiality, integrity, and availability of the system.
At the time of the CVE release on October 14, 2026, no active exploitation was known according to Wordfence. Given the critical CVSS score and the lack of authentication requirements, an immediate update to version 2.9.2 is still strongly recommended.
Check the directory wp-content/uploads/nbdesigner/temp/ should be checked for PHP files that are not expected there. If such files are present, the incident response process should be initiated.
As of: October 14, 2026. This article is for general informational purposes and does not constitute legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we make no warranty for timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-93388
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français