A critical 9.8 vulnerability in WooCommerce plugins

Two vulnerabilities have been patched in two popular plugins for WordPress-based e-commerce sites that let an attacker write files to the server and execute code without creating any account. Both flaws, added to the NVD on November 7, have a CVSS score of 9.8. The affected plugins are the payever payment gateway and the Printcart Store design module.

Unauthenticated code execution in the payever plugin

CVE-2026-93754 affects version 4.8.0 and earlier of the payever WooCommerce Gateway plugin. The issue comes from three functions in the plugin that can be called through the WooCommerce API: payever_set_sandbox_api_keys, payever_toggle_subscription, and payever_synchronization_incoming. These functions perform no authentication, no authorization checks, and no nonce validation.

The critical link in the chain is the upload_image() function. It writes a remotely fetched file into a publicly accessible uploads directory without checking the file type, and with a name controlled by the attacker. That allows an unauthenticated attacker to drop an executable PHP file and then call it from the browser to run code on the server. Wordfence classifies the flaw as CWE-434 (unrestricted file upload). In the same bug chain, an unauthorized credential overwrite issue caused by hardcoded credentials (CWE-862 and CWE-798) is also separately exploitable.

The same class of bug in Printcart Store

CVE-2026-19803 appears in version 2.13.2 and earlier of the Printcart Store plugin. The plugin’s nbu_crop_image AJAX handler appends the user-supplied url parameter to the uploads directory path, but does not strip ../ sequences. The output directory and file extension are also derived from that same attacker-controlled path.

The result is that PHP content can be written to an arbitrary location outside the uploads directory, and when the file is requested from the browser, it leads to remote code execution. The flaw is only exploitable when the nbdesigner_upload_popup_style setting is set to “a” (advanced upload window); in that case, the handler is also registered for unauthenticated requests. The required nonce is visible on the public design upload page, so an anonymous visitor can easily obtain it.

Update and checklist

Both flaws have been fixed. In payever version 4.9.0, store manager privileges and a nonce are now required for admin actions, and product image import now accepts only validated images. On the Printcart Store side, version 2.13.6 checks files coming from the designer and product options for both type and content; it rejects executable files and strips scripts from uploaded SVGs.

If you have either of these plugins installed on your store, first check the version number and then update the plugin. After updating, it’s a good idea to check the uploads directories for any unexpected PHP files; if you find anything suspicious, back up the site and clean it up. If you no longer use the plugin, disabling and deleting it will completely close off that attack surface.

Source: NVD · NVD