The Printcart Store – Web to Print Product Designer for WooCommerce plugin allows an unauthenticated attacker to upload arbitrary PHP code by exploiting the nbu_crop_image Ajax action. The handler accepts a user‑supplied url parameter, appends it to the uploads directory without normalizing path components, and writes the content using writeImage. Because the image extension is derived from the same attacker‑controlled path, an attacker can place a .php file in a location outside the intended uploads directory and subsequently execute it. The vulnerability exists when the nbdesigner_upload_popup_style site option is set to ‘a’ (Advanced Upload Popup), but the required nonce is printed on a public page, making the attack trivially available to anonymous users.

All releases of the Printcart Store plugin up to and including version 2.13.2 are affected. The vulnerability exists in the Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress. No specific build or patch level is exempt; users running any version ≤2.13.2 are vulnerable unless the vulnerable functionality is disabled.

The CVSS base score of 9.8 indicates that exploitation results in complete control over the system. The EPSS score for this issue is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but these factors do not reduce its potential impact. Exploitation requires only anonymous access to the site with the Advanced Upload Popup setting active; because the nonce is publicly rendered, attackers can obtain it without authentication. Once a malicious file is uploaded, remote execution is immediate if the file is served by the web server. Consequently, the risk to any site using a vulnerable plugin version is both high and low‑barrier to exploitation.