{"metadata": {"vulnerability": "CVE-2026-19803", "count": 15, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-13T20:32:02.319Z", "date_only": false, "value": "2026-08-13T20:32:02.319Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19803", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T15:17:27Z", "date_only": false, "value": "2026-11-06T15:17:27.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19803", "field": "containers.cna.timeline.0.time", "text": "Disclosed"}, {"timestamp": "2026-11-07T03:28:04.940Z", "date_only": false, "value": "2026-11-07T03:28:04.940Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19803", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-07T03:28:04.940Z", "date_only": false, "value": "2026-11-07T03:28:04.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19803", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-07T03:28:04.940Z", "date_only": false, "value": "2026-11-07T03:28:04.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19803", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-07T03:40:00.612Z", "date_only": false, "value": "2026-11-07T03:40:00.612041Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117573078220795027", "record": "CVE-2026-19803", "field": "creation_timestamp", "uuid": "2e3aa406-bf4a-4858-af56-8daa88e5d7a4", "content": "CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter The Printcart Store \u2013 Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path \u2014 with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to write attacker-controlled PHP content to arbitrary locations outside the uploads directory, resulting in remote code execution when the written file is subsequently requested. This vulnerability is only exploitable when the `nbdesigner_upload_popup_style` site option is set to `a` (Advanced Upload Popup), which causes the handler to be registered for unauthenticated requests; however, the required `save-design` nonce is printed on the fully public frontend `upload-design-file` page, making it trivially obtainable by any anonymous visitor once that configuration is active.\nhttps://www.cve.org/CVERecord?id=CVE-2026-19803https://www.wordfence.com/threat-intel/vulnerabilities/id/2525ed97-b701-4f95-8d8c-202e816723c5?source=cvehttps://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L284https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L272https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class-util.php#L165https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class.advanced.upload.php#L56https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.8.4/includes/class-util.php#L586https://plugins.trac.wordpress.org/changeset?reponame=&old=3747660%40printcart-integration&new=3747660%40printcart-integration#wordpress #printcart #PrintcartStore\u2013WebtoPrintProductDesignerforWooCommerce#CVE_2026_19803#bot", "url": "https://infosec.exchange/users/cve/statuses/117573078220795027"}, {"timestamp": "2026-11-07T04:17:29Z", "date_only": false, "value": "2026-11-07T04:17:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R27V-88R8-FHQ6", "record": "GHSA-R27V-88R8-FHQ6", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-07T04:17:29.233Z", "date_only": false, "value": "2026-11-07T04:17:29.233", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19803", "record": "FKIE_CVE-2026-19803", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T04:17:29.377Z", "date_only": false, "value": "2026-11-07T04:17:29.377", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19803", "record": "FKIE_CVE-2026-19803", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-07T04:20:03.015Z", "date_only": false, "value": "2026-11-07T04:20:03.015407Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzp27icvzp2u", "record": "CVE-2026-19803", "field": "creation_timestamp", "uuid": "9ec7bb5b-05c4-42a5-8179-1a51e7494d7c", "content": "CVE-2026-19803 - printcart store \u2013 web to print product designer for woocommerce\nThe Printcart Store plugin for WooCommerce lets a visitor upload a file to the server without logging in, and the uploaded file can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#printcart #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzp27icvzp2u"}, {"timestamp": "2026-11-07T05:18:49.784Z", "date_only": false, "value": "2026-11-07T05:18:49.784175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzp5ilhw352t", "record": "CVE-2026-19803", "field": "creation_timestamp", "uuid": "cbab10a4-41a3-4b8e-b0a0-c3f7a82c19ae", "content": "\ud83d\udd34 CVE-2026-19803 - Critical (9.8)\n\nThe Printcart Store \u2013 Web to Print Product Designer for WooCommerce plugin for WordPress is vul...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-19803/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzp5ilhw352t"}, {"timestamp": "2026-11-07T06:07:26.876Z", "date_only": false, "value": "2026-11-07T06:07:26.876252Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzpa7jocra2q", "record": "CVE-2026-19803", "field": "creation_timestamp", "uuid": "583852c3-b12e-4b69-b058-91f324f02631", "content": "\ud83d\udea8 CVE-2026-19803 \u2014 CVSS 9.8 CRITICAL\n\nThe Printcart Store \u2013 Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to A...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-19803\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzpa7jocra2q"}, {"timestamp": "2026-11-07T06:31:14Z", "date_only": false, "value": "2026-11-07T06:31:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R27V-88R8-FHQ6", "record": "GHSA-R27V-88R8-FHQ6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T06:31:14Z", "date_only": false, "value": "2026-11-07T06:31:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R27V-88R8-FHQ6", "record": "GHSA-R27V-88R8-FHQ6", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-08T00:00:18.765Z", "date_only": false, "value": "2026-11-08T00:00:18.765740Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mzr45wnynr2n", "record": "CVE-2026-19803", "field": "creation_timestamp", "uuid": "ca238bbc-88f0-4571-820e-1acdfafb1e87", "content": "CVE-2026-19803. CVSS 9.8. Printcart Store plugin lets anyone upload arbitrary files to your server. No auth required. Your wp-config.php, database backups, everything is exposed.\n\nUpdate to 2.13.2 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mzr45wnynr2n"}], "metrics": {"as_of": "2026-11-08T10:55:04.224Z", "anchors": {"origin": {"timestamp": "2026-11-07T03:28:04.940Z", "date_only": false, "value": "2026-11-07T03:28:04.940Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19803", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-07T03:28:04.940Z", "date_only": false, "value": "2026-11-07T03:28:04.940Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19803", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 113219.284814, "hours": 31.449801337222222, "days": 1.310408389050926, "min_seconds": 113219.284814, "max_seconds": 113219.284814, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-07T03:28:04.940Z", "date_only": false, "value": "2026-11-07T03:28:04.940Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19803", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T10:55:04.224Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}