A critical vulnerability in a WordPress plugin used by print shops lets anyone on the internet upload files to an affected site and run code on its server, with no login required.

The flaw, tracked as CVE-2026-19803 and scored 9.8 out of 10, affects the Printcart Store plugin — a web-to-print product designer for WooCommerce — in all versions up to and including 2.13.2. It was published in the National Vulnerability Database on 7 November.

The problem sits in the plugin's image-cropping handler, which accepts a web address supplied by the visitor and turns it into a file path on the server. The handler does not strip out `../` sequences, so an attacker can steer the path outside the uploads folder, and it derives both the output directory and the file extension from that same attacker-controlled path. Because the code writes the image without first stripping embedded content, an attacker can plant a PHP file where the web server will execute it.

Only some sites are exposed

The flaw can only be reached when a site has the plugin's upload option set to "Advanced Upload Popup". That setting registers the handler for visitors who are not logged in. The security token the handler asks for is printed on the plugin's fully public upload page, so any anonymous visitor can pick it up.

No public exploit code had been confirmed at the time of writing, and the flaw is not listed in CISA's catalogue of actively exploited vulnerabilities. Site owners using the plugin should update to the latest version, and anyone running the advanced upload popup should treat the update as urgent.