WooCommerce Printcart Store Plugin Arbitrary File Upload RCE

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to an unauthenticated arbitrary file upload that can lead to remote code execution in all versions up to and including 2.9.1.

The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers. Its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list applied on the other branch, and writes the fetched bytes to wp-content/uploads/nbdesigner/temp/.

• Affects all versions up to and including 2.9.1
• Unauthenticated attackers can write a .php file to a web-served, PHP-executing location
• By supplying their own Google Drive file and OAuth token as the content source, attackers can execute arbitrary code on the server
• The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier