{"metadata": {"vulnerability": "CVE-2026-93388", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-17T19:44:23.737Z", "date_only": false, "value": "2026-09-17T19:44:23.737Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-93388", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T13:14:38Z", "date_only": false, "value": "2026-10-13T13:14:38.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-93388", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-14T01:27:13.964Z", "date_only": false, "value": "2026-10-14T01:27:13.964Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93388", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T01:27:13.964Z", "date_only": false, "value": "2026-10-14T01:27:13.964Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-93388", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T02:17:01Z", "date_only": false, "value": "2026-10-14T02:17:01Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P5C5-938C-G6R5", "record": "GHSA-P5C5-938C-G6R5", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T02:17:01.720Z", "date_only": false, "value": "2026-10-14T02:17:01.720", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93388", "record": "FKIE_CVE-2026-93388", "field": "published"}, {"timestamp": "2026-10-14T02:46:34.977Z", "date_only": false, "value": "2026-10-14T02:46:34.977271Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxsjsatsya24", "record": "CVE-2026-93388", "field": "creation_timestamp", "uuid": "fea52094-93eb-436d-8fcb-01a44bfe0cb2", "content": "\ud83d\udd34 CVE-2026-93388 - Critical (9.8)\n\nThe Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93388/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxsjsatsya24"}, {"timestamp": "2026-10-14T03:30:39Z", "date_only": false, "value": "2026-10-14T03:30:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P5C5-938C-G6R5", "record": "GHSA-P5C5-938C-G6R5", "field": "published"}, {"timestamp": "2026-10-14T03:30:39Z", "date_only": false, "value": "2026-10-14T03:30:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P5C5-938C-G6R5", "record": "GHSA-P5C5-938C-G6R5", "field": "modified"}, {"timestamp": "2026-10-14T04:07:26.581Z", "date_only": false, "value": "2026-10-14T04:07:26.581687Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsocu4yzc2l", "record": "CVE-2026-93388", "field": "creation_timestamp", "uuid": "dabd4be7-b987-4132-afb0-d43fb9a04675", "content": "\ud83d\udea8 CVE-2026-93388 \u2014 CVSS 9.8 CRITICAL\n\nThe Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93388\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsocu4yzc2l"}, {"timestamp": "2026-10-14T08:10:05.363Z", "date_only": false, "value": "2026-10-14T08:10:05.363672Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt3upq6sx24", "record": "CVE-2026-93388", "field": "creation_timestamp", "uuid": "dc950e0b-1109-4739-9660-0e0bfe3fdbe9", "content": "CVE-2026-93388 - printcart store \u2013 web to print product designer for woocommerce\nThe Printcart Store design plugin for WooCommerce (versions up to 2.9.1) lets anyone on the internet upload a malicious file to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#printcart #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt3upq6sx24"}, {"timestamp": "2026-10-14T16:20:11.215Z", "date_only": false, "value": "2026-10-14T16:20:11.215423Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440171915431254", "record": "CVE-2026-93388", "field": "creation_timestamp", "uuid": "5045447b-ebb0-43d9-93fb-70da4b8b44db", "content": "CVE-2026-93388 Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter \u2014 bypassing the jpg/jpeg/png/gif allow-list applied on the other branch \u2014 and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.\nhttps://www.cve.org/CVERecord?id=CVE-2026-93388https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=cvehttps://plugins.trac.wordpress.org/changeset?reponame=&new=3716244%40printcart-integration%2Ftags%2F2.9.2&old=3715643%40printcart-integration%2Ftags%2F2.9.1https://plugins.trac.wordpress.org/changeset/3716244/printcart-integration/trunk/includes/class.nbdesigner.php#printcart #PrintcartStore\u2013WebtoPrintProductDesignerforWooCommerce#CVE_2026_93388#bot", "url": "https://infosec.exchange/users/cve/statuses/117440171915431254"}, {"timestamp": "2026-10-14T17:55:19.566Z", "date_only": false, "value": "2026-10-14T17:55:19.566462Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93388", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T17:55:19.566Z", "date_only": false, "value": "2026-10-14T17:55:19.566462Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93388", "record": "FKIE_CVE-2026-93388", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T17:55:31.470Z", "date_only": false, "value": "2026-10-14T17:55:31.470Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-93388", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:55:31.470Z", "date_only": false, "value": "2026-10-14T17:55:31.470Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93388", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:19:35.843Z", "date_only": false, "value": "2026-10-14T18:19:35.843", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93388", "record": "FKIE_CVE-2026-93388", "field": "lastModified"}]}