CVSS 9.8: Printcart Store Google Drive Endpoint Flaw Enables Unauthenticated RCE on v2.9.1

The Printcart Store plugin for WooCommerce contains a critical security flaw that permits unauthenticated remote code execution. This vulnerability affects all plugin releases up to version 2.9.1, exposing organisations that rely on web-to-print functionality to significant operational risk. The issue stems from improper handling of file uploads within the plugin’s design interface, specifically when interacting with external cloud storage services.

Root cause

The core issue lies in the `nbdesigner_copy_image_from_url` AJAX action, which is registered for logged-out users via the `wp_ajax_nopriv_` prefix. According to the NVD record, the plugin’s Google Drive integration branch reconstructs the destination filename using the raw, attacker-supplied `gapi[name]` parameter. This process bypasses the standard allow-list that restricts uploads to jpg, jpeg, png, and gif formats. Consequently, the fetched bytes are written directly to the web-accessible `wp-content/uploads/nbdesigner/temp/` directory.

Attack path

An attacker can exploit this by supplying their own Google Drive file and OAuth token as the content source. The required save-design nonce, which might otherwise act as a barrier, is issued to anonymous callers by the `nbd_check_use_logged_in` endpoint. This allows unauthenticated users to write a PHP file to a location that executes server-side code. Once the malicious file is uploaded, the attacker can execute arbitrary commands on the server, potentially leading to full system compromise.

Affected versions

• Printcart Store – Web to Print Product Designer for WooCommerce up to 2.9.1

Mitigation

• Identify all instances of the Printcart Store plugin within your infrastructure.
• Verify the installed version against the affected range (up to 2.9.1).
• Monitor server logs for suspicious file uploads or unusual AJAX requests to the plugin’s endpoints.
• Consult the vendor for any available patches or temporary workarounds.

What it means for organisations

Teams should immediately review their plugin inventory to determine exposure to this flaw. Security and development leads need to assess the risk of unauthenticated access to design tools. Operations managers should evaluate the potential impact on customer data and server integrity if remote code execution occurs. Internal communication should highlight the severity of unpatched third-party components. Procurement teams may need to question vendors about their security testing processes for integrations with external services like Google Drive.

What to do and how to stay safe: Printcart Store

• Audit your WooCommerce installations for the Printcart Store plugin and check version numbers.
• Restrict access to the plugin’s AJAX endpoints if possible until a fix is available.
• Monitor web server logs for unusual file creation in upload directories.
• Prepare an incident response plan in case of detected compromise.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of the Printcart Store vulnerability?

The National Vulnerability Database rates CVE-2026-93388 as critical with a CVSS score of 9.8.

Can attackers exploit this without logging in?

Yes, the vulnerability allows unauthenticated arbitrary file upload and remote code execution.

Which versions of the plugin are affected?

All versions of the Printcart Store plugin up to and including version 2.9.1 are vulnerable.