Printcart Store EUVD-2026-100765

Requires only that the Printcart Store (PCDesigner / NB Designer) plugin version ≤2.9.1 be installed and active; exploitation specifically invokes the Google Drive branch of the nbdesigner_copy_image_from_url AJAX action, where the attacker must supply gapi[name] (the raw attacker-controlled filename, e.g. ending in .php) along with their own Google Drive file and OAuth token as the fetched content source. No authentication is needed (PR:N) and the save-design nonce is freely issued by nbd_check_use_logged_in, so that is not a barrier. The practical limiting factor is that the uploads/nbdesigner/temp/ directory must actually execute PHP when requested - default on typical Apache/mod_php stacks but blocked where the uploads directory has PHP execution disabled or is served by a hardened configuration; the attacker must also control a reachable Google Drive file and a valid OAuth token for the content fetch.

All provided signals point to a genuine high-priority flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity attack with full C:H/I:H/A:H impact, consistent with the described unauthenticated arbitrary-file-upload-to-RCE chain - the metrics and the technical narrative agree, which is reassuring. The chain is also self-contained: the required save-design nonce is dispensed to anonymous callers by nbd_check_use_logged_in, so the usual nonce barrier is neutralized, reinforcing the PR:N rating. However, several decision signals are MISSING from the input: no EPSS exploitation-probability score is provided, there is no CISA KEV entry, and no POC/exploit-code availability is indicated, nor is an SSVC decision record supplied - so automatability and in-the-wild status cannot be confirmed from this data. The one tempering factor is deployment footprint: this is a niche WooCommerce web-to-print plugin, so despite the 9.8 score the realistic blast radius is far smaller than a comparable flaw in a ubiquitous component. Net: treat as a real, patch-now issue for any site running the plugin (unauthenticated RCE in WordPress plugins is routinely mass-scanned once disclosed), but recognize that absent EPSS/KEV/POC confirmation the current evidence shows exploitability-by-design rather than proven active exploitation.

An unauthenticated attacker first retrieves the freely-handed save-design nonce from the nbd_check_use_logged_in endpoint, then invokes the wp_ajax_nopriv_ nbdesigner_copy_image_from_url action using its Google Drive branch, supplying a gapi[name] value ending in '.php' plus their own Google Drive file and OAuth token as the content source. Because the Drive branch skips the jpg/jpeg/png/gif allow-list, the server writes attacker-controlled PHP bytes into the web-accessible wp-content/uploads/nbdesigner/temp/ directory, which the attacker then requests to execute arbitrary code. No public exploit identified at time of analysis, but the low-complexity network vector makes this trivially weaponizable once understood.