Printcart Store plugin: critical file upload flaw (CVE-2026-19803)

What CVE-2026-19803 is and who it affectsThe National Vulnerability Database (NVD) of NIST has published CVE-2026-19803, a critical flaw in the WordPr...

What CVE-2026-19803 is and who it affects

The National Vulnerability Database (NVD) of NIST has published CVE-2026-19803, a critical flaw in the WordPress plugin Printcart Store – Web to Print Product Designer for WooCommerce. Every version up to and including 2.13.2 is affected. The vulnerability was published on 7 November 2026 and carries a CVSS 3.1 score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The underlying weakness is classified as CWE-94, code injection.

In plain terms, the plugin allows an arbitrary file upload. Its nbu_crop_image AJAX handler takes a user-supplied url parameter and passes it to the plugin's internal path conversion routine, which appends it to the uploads base directory without normalising or stripping ../ sequences. The output directory and the output file extension are then both derived from that same attacker-controlled path, and no image sanitisation step runs before the file is written. An attacker can therefore write PHP content outside the uploads directory, and the code executes when the written file is later requested.

One condition matters for anyone assessing exposure: the flaw is only exploitable when the nbdesigner_upload_popup_style site option is set to a (Advanced Upload Popup), which is what registers the handler for unauthenticated requests. In that configuration, the required save-design nonce is printed on the fully public upload-design-file frontend page, so any anonymous visitor can obtain it. The result is remote code execution without authentication.

This is directly relevant to Spanish SMEs, online shops and businesses running WooCommerce on WordPress, particularly print-on-demand and personalised-product stores in Barcelona, Lleida, Tarragona and Girona where a product designer plugin is part of the sales flow.

Why it deserves attention now

The material consulted does not list CVE-2026-19803 in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record of it being exploited in real attacks at the time of writing. That is not a reason to relax. A CVSS 9.8 with no privileges and no user interaction required is the profile attackers scan for automatically, and a public nonce on a frontend page removes the last obstacle.

Two further factors raise the practical risk for smaller organisations. First, WordPress plugins are frequently installed for a single campaign or product line and then forgotten, so an outdated copy can sit on a server long after anyone remembers it. Second, unauthenticated file upload flaws do not announce themselves: a well-placed PHP file leaves the site looking normal while giving the attacker a foothold for persistence, data theft or use of the server as a relay. Under GDPR, a compromise of a shop that stores customer names, addresses and order histories is a personal data breach with notification obligations.

What to do today

Check whether the plugin is installed and at which version. Look in the WordPress plugin list for Printcart Store – Web to Print Product Designer for WooCommerce. Anything at or below 2.13.2 falls within the affected range.
Check the site option. Confirm whether nbdesigner_upload_popup_style is set to a. If it is, the unauthenticated path is live and the priority is higher.
Apply the fix indicated by the vendor's advisory. The material consulted does not state which release corrects the flaw, so follow the plugin author's security notice rather than assuming a version number. If no update is available yet, remove or disable the plugin until one is.
Look for signs of intrusion. Review the uploads directory and its subfolders for unexpected PHP files, check server logs for requests to the crop handler with unusual path parameters, and look for recently modified files outside the normal update window.
Reduce what is exposed to the internet. Restrict access to administrative paths, keep a tested backup taken before any change, and make sure file permissions prevent the web server from writing executable code where it should not.

How a cybersecurity team such as ALMC's can help

Situations like this one are usually less about a single CVE and more about not knowing what is running where. ALMC's cybersecurity work for businesses starts with security audits and pentesting to map the real attack surface of a WordPress, PrestaShop or Joomla installation, including the plugins and modules nobody has reviewed in years, and to close vulnerabilities before they are exploited.

From there, server hardening and ongoing monitoring and incident response cover the gap between disclosure and patching, which is exactly where unauthenticated upload flaws do their damage. For shops without a dedicated IT department, maintenance and updating of WordPress, PrestaShop and Joomla keeps third-party components current, and if a site has already been hacked, the team handles the repair and cleanup. The goal is simple: fewer forgotten plugins, faster patching and a clear picture of what is exposed, so a critical advisory becomes a routine task rather than an emergency.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.