CVE-2026-19803: File Upload Risk in Printcart Plugin
This text was generated using artificial intelligence (AI).CVE-2026-19803 affects the WordPress plugin Printcart Store – Web to Print Product Designer for WooCommerce in all versions up to and including 2.13.2. According to Wordfence, the vulnerability receives a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Under a specific upload configuration, unauthenticated attackers can place controlled PHP content outside the intended upload directory. If the created file is subsequently accessed, this may allow code execution on the affected server.
The vulnerability is located in the AJAX handler nbu_crop_image. This processes a passed urlparameter with Nbdesigner_IO::convert_url_to_path.
According to Wordfence, ../-sequences are not normalized or removed during processing. The resulting path is appended to the base directory for uploads. The target directory and file extension are then derived using pathinfo from the same controlled path. No call to stripImage.
occurs before writing the file. This allows an attacker to write controlled PHP content to paths outside the upload directory. Code execution assumes that the deposited file is subsequently retrieved via the web server.
Unauthenticated accessibility is tied to a specific setting: The site option nbdesigner_upload_popup_style must contain the value a for Advanced Upload Popup In this case, the handler for unauthenticated requests is registered. The required save-design-Nonce is issued on the publicly accessible page upload-design-file and can therefore be retrieved by anonymous visitors.
Check vulnerability and limit risk
For WordPress and WooCommerce instances with Printcart, it should first be checked whether a version up to and including 2.13.2 is in use and whether Advanced Upload Popup is active.
The following steps are planned for affected systems:
Check the patch status and vulnerability for CVE-2026-19803.
Check if nbdesigner_upload_popup_style on a is set.
Deactivate the plugin if Advanced Upload Popup is active and no fixed version can be installed yet.
Block the AJAX endpoint nbu_crop_image via a WAF or server configuration, if deactivation is not possible.
Examine upload directories and adjacent paths for unexpectedly placed PHP files.
Install a fixed plugin version released by the manufacturer as soon as it is available.
For further processing, affected systems should be prioritized and the plugin inventory maintained. This includes mapping domains to WordPress installations as well as recording used extensions and their versions.
Operators of WooCommerce shops in Germany and Austria who are subject to NIS-2 or the respective national implementation law should check whether successful exploitation constitutes a reportable security breach. In Germany, the BSI is the responsible reporting authority; the 72-hour deadline under Art. 33 GDPR also applies if personal data is affected. For Swiss operators, since the revised Information Security Act (ISG), there is a reporting obligation to the BACS.
Capture externally accessible shop systems
CVE-2026-19803 affects a server-side installed extension in WooCommerce environments. Such applications can be run under customer domains and are externally recognizable via plugin-related paths, assets, or WordPress fingerprinting.
LocateRisk supports External Attack Surface Management by making externally accessible assets and deployed software visible. For this case, this visibility can serve to capture publicly accessible WordPress and WooCommerce systems as test objects. The specific vulnerable plugin version must then be checked against the own inventory and the installed software.
Continuous monitoring can capture newly accessible systems, orphaned subdomains, and unexpectedly published web applications. The assessment of CVE-2026-19803 additionally requires clear responsibilities for plugin updates, configuration checks, and the investigation of suspicious PHP files.
Am I affected?
The affected version is Printcart Store in the versions mentioned above. Those who want to know whether Printcart Store is even visible in their own externally accessible infrastructure can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
All versions of the plugin are affected Printcart Store – Web to Print Product Designer for WooCommerce up to and including 2.13.2. A corrected version was not available at the time of publication of this message.
Exploitation requires that the site option nbdesigner_upload_popup_style is set to the value of a (Advanced Upload Popup). If this setting is not active, the affected AJAX handler is not registered for unauthenticated requests, significantly reducing the attack surface. However, checking the configuration is still recommended.
Until a corrected plugin version is available, it is advisable to deactivate the plugin or — if that is not possible — to block the AJAX endpoint nbu_crop_image via a WAF or server configuration. Additionally, upload directories and adjacent paths should be checked for unexpectedly placed PHP files.
As of November 07, 2026. This article is for general informational purposes only and is not legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always decisive. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-19803
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français