AI analysis
Claude Opus · 8 Nov 2026, 10:20 CET
Printcart WooCommerce design plugin allows unauthenticated remote code execution
A critical flaw in the Printcart Store plugin for WooCommerce lets unauthenticated attackers upload malicious PHP files and run code on the server when the Advanced Upload Popup option is active. Affects all versions up to and including 2.13.2.
In plain terms
Printcart Store is a WordPress plugin that lets WooCommerce shops offer customizable, print-ready products. A flaw in how one of its upload features handles file paths means an attacker who has never logged in can place a harmful PHP file (a script the server will run) outside the normal upload folder and then trigger it, giving them control over the site.
This matters for any online store running this plugin, especially if the Advanced Upload Popup feature is enabled. A successful attack can lead to full compromise of the website and its underlying server.