Printcart Store Arbitrary File Upload Flaw Enables Unauthenticated RCE on WooCommerce
An arbitrary file upload flaw in the Printcart Store plugin allows attackers to execute remote code on affected WooCommerce sites without authentication.
Key points
- The vulnerability affects all versions of the Printcart Store plugin up to and including 2.9.1.
- Attackers can bypass file type restrictions by exploiting a Google Drive integration branch.
- The flaw enables unauthenticated arbitrary code execution with a CVSS score of 9.8.
The Printcart Store plugin for WooCommerce contains a critical security flaw that permits unauthenticated remote code execution. This issue affects all plugin versions through 2.9.1 and exposes web servers to direct compromise by external attackers.
What happened
The vulnerability resides in the `nbdesigner_copy_image_from_url` AJAX action, which is accessible to logged-out users via the `wp_ajax_nopriv_` handler. According to the NVD record, the Google Drive branch of this function reconstructs destination filenames using the raw `gapi[name]` parameter supplied by the attacker. This process bypasses the standard allow-list for image formats such as jpg, jpeg, png, and gif.
Consequently, an attacker can write files with executable extensions, such as .php, to the `wp-content/uploads/nbdesigner/temp/` directory. The required save-design nonce is not a barrier because the `nbd_check_use_logged_in` endpoint provides it to anonymous callers. By supplying a custom Google Drive file and OAuth token, attackers can place arbitrary code in a web-accessible location.
Why it matters
Environments running WooCommerce with the Printcart Store plugin are directly exposed to unauthenticated attackers. The ability to write executable files to a web-served directory means attackers can gain full control of the server without needing valid user credentials. This mirrors the severity of other recent unauthenticated remote code execution flaws reported in the publication's archive, highlighting a persistent risk in web application ecosystems.
Next steps
- Identify all instances of the Printcart Store plugin on your WooCommerce installations.
- Verify whether any site is running version 2.9.1 or earlier.
- Monitor web server access logs for requests to the `nbdesigner_copy_image_from_url` action.
- Check the `wp-content/uploads/nbdesigner/temp/` directory for unexpected files.
Detection notes
Security operations teams should monitor web server logs for unusual POST requests to AJAX endpoints that accept file uploads. Look for requests containing parameters related to Google Drive integration or file name manipulation. Alert on any file creation events in upload directories that do not match expected image formats. Check for outbound connections to cloud storage services initiated by the web server process. Investigate any newly created files with executable extensions in temporary storage folders. Review authentication logs for anonymous access to endpoints that should require user login.
Background: OAuth
OAuth provides delegated, short-lived access for users and services, allowing precise permission control. API keys offer static, long-term identity for server-to-server communication. Choose OAuth for user data and fine-grained control. Choose API keys for simple, automated backend integrations where user context is irrelevant.
Read the full guide: OAuth vs API Key: When to Use Tokens and When to Use Secrets
What to do and how to stay safe: Printcart Store
- Audit your WooCommerce plugins for the Printcart Store component and check installed versions.
- Review server access logs for suspicious activity targeting the plugin's AJAX actions.
- Inspect temporary upload directories for files with executable extensions or unexpected names.
- Implement strict file type validation on all upload endpoints until a vendor update is provided.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Printcart Store plugin are affected by this vulnerability?
All versions up to and including 2.9.1 are vulnerable to unauthenticated remote code execution.
How do attackers bypass the file type restrictions in this plugin?
They exploit the Google Drive branch, which uses the raw `gapi[name]` parameter to set filenames, bypassing the image allow-list.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to execute code because the necessary nonce is provided to anonymous callers.
