The Printcart Store – Web to Print Product Designer for WooCommerce plugin is vulnerable to unauthenticated arbitrary file upload, allowing an attacker to place a PHP file in a web‑accessible location and execute it on the server. The nbdesigner_copy_image_from_url AJAX action is exposed to anonymous callers and, in its Google Drive branch, rebuilds the destination filename from the attacker supplied gapi[name] parameter, bypassing the allowed jpg/jpeg/png/gif filters applied elsewhere. The fetched contents are written to wp‑content/uploads/nbdesigner/temp/, a directory that serves PHP files. An attacker can supply a malicious PHP file via a Google Drive link and OAuth token, resulting in remote code execution without any authentication.

Affected Systems The vulnerability affects all installations of the Printcart Store – Web to Print Product Designer for WooCommerce plugin up to and including version 2.9.1. Any WordPress site running WooCommerce with this plugin can be compromised if the affected version is in use.

The CVSS score is 9.8, indicating critical severity. The EPSS score is below 1 %, showing a very low current exploitation probability, but the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw via the unauthenticated AJAX endpoint nbdesigner_copy_image_from_url, upload a malicious PHP file to the temporary directory, and execute arbitrary code on the server. The absence of authentication or nonce checks removes any significant barriers, making exploitation straightforward for anyone with internet access to the site.