CVE-2026-93388

Name of the Vulnerable Software and Affected Versions Printcart Store (PCDesigner / NB Designer) versions prior to 2.9.2

Description An unauthenticated arbitrary file upload issue exists that can lead to remote code execution. The nbdesigner copy image from url AJAX action is accessible to logged-out users. Within the Google Drive processing branch, the plugin reconstructs the destination filename using the raw gapi[name] parameter, which bypasses the image extension allow-list. This allows an attacker to upload a .php file to the wp-content/uploads/nbdesigner/temp/ directory. By providing a malicious Google Drive file and a valid OAuth token, an attacker can execute arbitrary code on the server. The nbd check use logged in endpoint provides the necessary save-design nonce to anonymous users, removing any authentication barrier.

Recommendations Update the plugin to a version newer than 2.9.1. As a temporary mitigation, restrict access to the nbdesigner copy image from url AJAX action or the nbd check use logged in endpoint.