Printcart Store: arbitrary file upload leading to RCE (CVE-2026-19803)
A vulnerability, CVE-2026-19803 (CVSS 9.8), was published in the Printcart Store – Web to Print Product Designer for WooCommerce plugin. The `nbu_crop_image` AJAX handler accepts a `url` parameter without normalizing `../`, so an unauthenticated attacker can write a PHP file outside the uploads directory.
Checked in Shield: no
Who is affected
All plugin versions up to and including 2.13.2. It is exploitable only when the `nbdesigner_upload_popup_style` option is set to `a` (Advanced Upload Popup). The `save-design` nonce is exposed on the public `upload-design-file` page.
How to check
In the WordPress admin, open the Plugins list and check the Printcart version. You can read the option with `wp option get nbdesigner_upload_popup_style` or in the plugin settings.
How to fix
The source does not name a fixed version. Until a patch is published, you can deactivate the plugin or avoid the Advanced Upload Popup mode, and watch for an update.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and any real-world exploitation are not disclosed yet. Source: NVD, CVE-2026-19803.
