{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pcdesigner--2.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:printcart:pcdesigner:*:*:*:*:*:wordpress:*:*","cpe:2.3:a:printcart:nb_designer:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-93388"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PCDesigner (\u003c= 2.9.1)","NB Designer (\u003c= 2.9.1)"],"_cs_severities":["critical"],"_cs_tags":["web-application-vulnerability","rce","file-upload","ecommerce"],"_cs_type":"advisory","_cs_vendors":["Printcart"],"content_html":"\u003cp\u003eThe Printcart Store plugins, specifically PCDesigner and NB Designer for WooCommerce, are vulnerable to unauthenticated remote code execution due to improper input validation in the 'nbdesigner_copy_image_from_url' AJAX action. All versions up to and including 2.9.1 are affected. An attacker can exploit this by utilizing the 'nbd_check_use_logged_in' endpoint to retrieve a valid save-design nonce. Following this, the attacker targets the 'nbdesigner_copy_image_from_url' AJAX action, specifically the Google Drive branch. By manipulating the 'gapi[name]' parameter, the attacker can bypass existing file extension allow-lists that typically restrict files to image formats (jpg, jpeg, png, gif). This allows the attacker to write an arbitrary .php file to the 'wp-content/uploads/nbdesigner/temp/' directory, which is web-accessible and parsed by the server. Successful exploitation enables the execution of arbitrary code under the web server user context.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a request to the 'nbd_check_use_logged_in' endpoint to obtain a valid nonce, even as an unauthenticated user.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a remote Google Drive source containing a malicious PHP payload.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an HTTP POST request to the 'admin-ajax.php' file triggering the 'nbdesigner_copy_image_from_url' action.\u003c/li\u003e\n\u003cli\u003eAttacker includes the required nonce and targets the Google Drive branch of the function.\u003c/li\u003e\n\u003cli\u003eAttacker injects a filename ending in .php via the 'gapi[name]' parameter to bypass extension filtering.\u003c/li\u003e\n\u003cli\u003eThe plugin fetches the malicious content from the attacker-controlled Google Drive URL.\u003c/li\u003e\n\u003cli\u003eThe plugin writes the malicious PHP file to 'wp-content/uploads/nbdesigner/temp/'.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the newly created file via a browser to trigger remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full remote code execution on the WordPress host. This permits unauthorized access to sensitive application data, database contents, and the potential for lateral movement within the network. All instances of the Printcart Store plugins up to version 2.9.1 are affected, exposing e-commerce sites to complete compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to the latest version of PCDesigner and NB Designer immediately upon the release of a security patch by Printcart.\u003c/li\u003e\n\u003cli\u003eMonitor access logs for requests to 'admin-ajax.php' containing parameters related to 'nbdesigner_copy_image_from_url' combined with suspicious file extensions in the query string.\u003c/li\u003e\n\u003cli\u003eRestrict write access to the 'wp-content/uploads/nbdesigner/temp/' directory if possible, or implement server-side rules to prevent the execution of PHP files within the uploads directory.\u003c/li\u003e\n\u003cli\u003eUtilize the detection rule provided below to identify exploitation attempts targeting the AJAX action.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:35:17Z","date_published":"2026-10-14T04:35:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-woocommerce-plugin-rce/","summary":"An unauthenticated arbitrary file upload vulnerability in the Printcart Store (PCDesigner / NB Designer) WooCommerce plugin allows remote code execution via AJAX parameter manipulation.","title":"Arbitrary File Upload in Printcart WooCommerce Plugins","url":"https://feed.craftedsignal.io/briefs/2026-10-woocommerce-plugin-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - PCDesigner (\u003c= 2.9.1)","version":"https://jsonfeed.org/version/1.1"}