{"vulnerability": "CVE-2026-93388", "sightings": [{"uuid": "fea52094-93eb-436d-8fcb-01a44bfe0cb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93388", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxsjsatsya24", "content": "\ud83d\udd34 CVE-2026-93388 - Critical (9.8)\n\nThe Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93388/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-14T02:46:34.977271Z"}, {"uuid": "dabd4be7-b987-4132-afb0-d43fb9a04675", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93388", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxsocu4yzc2l", "content": "\ud83d\udea8 CVE-2026-93388 \u2014 CVSS 9.8 CRITICAL\n\nThe Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93388\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-14T04:07:26.581687Z"}, {"uuid": "dc950e0b-1109-4739-9660-0e0bfe3fdbe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93388", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxt3upq6sx24", "content": "CVE-2026-93388 - printcart store \u2013 web to print product designer for woocommerce\nThe Printcart Store design plugin for WooCommerce (versions up to 2.9.1) lets anyone on the internet upload a malicious file to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#printcart #CVE #infosec", "creation_timestamp": "2026-10-14T08:10:05.363672Z"}, {"uuid": "5045447b-ebb0-43d9-93fb-70da4b8b44db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93388", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117440171915431254", "content": "CVE-2026-93388 Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter \u2014 bypassing the jpg/jpeg/png/gif allow-list applied on the other branch \u2014 and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.\nhttps://www.cve.org/CVERecord?id=CVE-2026-93388https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=cvehttps://plugins.trac.wordpress.org/changeset?reponame=&new=3716244%40printcart-integration%2Ftags%2F2.9.2&old=3715643%40printcart-integration%2Ftags%2F2.9.1https://plugins.trac.wordpress.org/changeset/3716244/printcart-integration/trunk/includes/class.nbdesigner.php#printcart #PrintcartStore\u2013WebtoPrintProductDesignerforWooCommerce#CVE_2026_93388#bot", "creation_timestamp": "2026-10-14T16:20:11.215423Z"}]}