CVE-2026-19803: RCE in Printcart Store for WooCommerce

CVE-2026-19803 is an unauthenticated arbitrary file upload vulnerability in the Printcart Store plugin for WooCommerce. An AJAX handler accepts an attacker-controlled parameter, concatenates it without validation to WordPress's uploads directory, and writes it to disk without sanitization. An unauthenticated attacker can write arbitrary files outside the uploads folder, achieving remote code execution when the file is requested. The plugin is deployed on thousands of WordPress e-commerce sites in production.

CVSS 9.8 (Critical). The vulnerability was published on 2026-11-07 on the NVD and is immediately being discussed on X with 3 posts in the last 24 hours. No official patch is available yet from the vendor. The flaw is exploitable only if the site uses the advanced upload popup, but the required nonce for exploitation is printed publicly on the frontend upload page, making it trivially obtainable by any anonymous visitor once that configuration is active.

Immediately verify if Printcart Store is installed and which version is in use. If version 2.13.2 or earlier is present, check if the advanced upload popup is enabled in the WordPress database. If enabled, the site is vulnerable and requires urgent action. Pending an official patch from the vendor: disable the advanced upload popup, restrict access via WAF, monitor access logs in the uploads folder and adjacent directories, isolate the site until a patch is available.