Description

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-07T04:17:29.233Z",
  "pubdate": "2026-11-07T04:17:29.233Z",
  "executiveSummary": "The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability, categorized as a severe security flaw.\nThis vulnerability exists in all versions up to, and including, 2.13.2.\nThe flaw allows unauthenticated remote attackers to execute arbitrary PHP code on the underlying server, potentially leading to full site compromise.\nThe vulnerability is triggered via the nbu_crop_image AJAX handler when the site configuration option nbdesigner_upload_popup_style is set to 'a'.\nWhile the operation requires a save-design nonce, this token is publicly accessible to anonymous visitors on the frontend upload-design-file page.\nSuccessful exploitation enables attackers to bypass filesystem restrictions and write malicious scripts to arbitrary locations within the server environment, resulting in Remote Code Execution (RCE).\nOrganizations using this plugin are at high risk until the vulnerable component is secured or updated.",
  "technicalDetails": "The root cause of the vulnerability resides in the nbu_crop_image AJAX handler, which fails to adequately sanitize the user-supplied 'url' parameter before utilizing it in filesystem operations.\nSpecifically, the Nbdesigner_IO::convert_url_to_path() function performs a concatenation of the user-provided URL onto the uploads base directory path without normalizing the path string or stripping directory traversal sequences, such as '../'.\nFurthermore, the output directory and file extension are derived using pathinfo() directly from the attacker-controlled input string, and the process lacks the necessary stripImage() invocation prior to the execution of writeImage().\nThis combination of improper input validation and insecure file handling enables an attacker to traverse the directory structure outside of the intended uploads directory.\nThe exploitation process begins when an attacker identifies a target installation where the nbdesigner_upload_popup_style option is set to 'a'.\nBecause the required save-design nonce is exposed on the frontend upload-design-file page, an unauthenticated attacker can retrieve this nonce to authorize the malicious AJAX request.\nThe attacker submits a specially crafted request containing a 'url' parameter configured with directory traversal sequences to target a specific path on the server.\nBy manipulating the request, the attacker forces the application to write arbitrary PHP content—injected via the payload—to a location where the web server will execute the file upon a direct HTTP request.\nBecause there is no validation logic to prevent the creation of executable file extensions in sensitive locations, the plugin effectively grants the attacker the ability to upload a webshell.\nOnce the file is written, the attacker can execute arbitrary commands with the privileges of the web server user by navigating to the path of the newly uploaded file.\nThis results in total compromise of the application, including access to database credentials, sensitive configuration files, and the ability to modify or delete existing content.\nThe vulnerability is technically impactful because it circumvents standard WordPress security protections and directly leverages server-side write operations."
}