{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:55:19.566462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:55:31.470Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Printcart Store \u2013 Web to Print Product Designer for WooCommerce",
          "vendor": "printcart",
          "versions": [
            {
              "lessThanOrEqual": "2.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osman Hussein"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter \u2014 bypassing the jpg/jpeg/png/gif allow-list applied on the other branch \u2014 and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T01:27:13.964Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3716244%40printcart-integration%2Ftags%2F2.9.2\u0026old=3715643%40printcart-integration%2Ftags%2F2.9.1"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3716244/printcart-integration/trunk/includes/class.nbdesigner.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T13:14:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) \u003c= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-93388",
    "datePublished": "2026-10-14T01:27:13.964Z",
    "dateReserved": "2026-09-17T19:44:23.737Z",
    "dateUpdated": "2026-10-14T17:55:31.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T14:40:07.304391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T14:42:24.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Printcart Store \u2013 Web to Print Product Designer for WooCommerce",
          "vendor": "printcart",
          "versions": [
            {
              "lessThanOrEqual": "2.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Spy0x7"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the \u0027mockups\u0027 parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T07:40:01.628Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d050a44-41ac-46ac-ba2e-406bfaebec69?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.5.2/includes/class.resource.php#L220"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.5.2/includes/class.resource.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.5.2/includes/class.resource.php#L27"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/printcart-integration/tags/2.5.2/includes/class.nbdesigner.php#L213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3658512%40printcart-integration\u0026new=3658512%40printcart-integration"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-17T18:41:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Printcart Web to Print Product Designer for WooCommerce \u003c= 2.8.5 - Unauthenticated Arbitrary File Read via \u0027folder\u0027 and \u0027mockups\u0027 Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-14323",
    "datePublished": "2026-09-18T07:40:01.628Z",
    "dateReserved": "2026-07-01T12:13:42.189Z",
    "dateUpdated": "2026-09-18T14:42:24.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}