CVE-2026-82187: Unauthenticated Arbitrary File Upload in Web to Print Online Designer

Overview

A critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-82187, affects the Web to Print Online Designer plugin (published on WordPress.org as the Printcart Web To Print Product Designer for WooCommerce). The plugin lets WooCommerce stores offer live product customization — think custom mugs, apparel, and signage — but its upload handler does not check what kind of file it's been handed, and it hands out the token meant to protect that endpoint to anyone who asks.

The combination means an attacker with no account and no prior interaction with the target site can upload a PHP file disguised as a design asset and get it executed directly on the server.

Technical Details

How It Works

The plugin's file-upload endpoint is meant to be gated by a security token — but that token is retrievable by any visitor who requests it, authenticated or not. Once an attacker has the token in hand, the upload handler itself performs no validation of file type or extension, so a .php file submitted as if it were a customer-uploaded design asset (a JPEG, PNG, or PDF for the print job) is accepted and written to a web-accessible directory. Requesting that file directly executes it, handing the attacker code execution in the context of the web server.

This is a textbook CWE-434 chain: a missing authorization control feeding a missing content-type/extension check, with remote code execution as the end result — no login, no social engineering, no CSRF token guessing required.

Impact Assessment

Who Is At Risk

• Any WooCommerce store running Web to Print Online Designer / Printcart Web To Print Product Designer on a version prior to 2.15.0 with the upload endpoint reachable from the internet — which, for a live product-customization feature, is essentially all production installs
• Print-on-demand, promotional merchandise, and signage shops are the plugin's core user base, making this a supply-chain-adjacent risk for any print vendor integration built on top of affected stores

Potential Impact

• Full remote code execution on the web server hosting the WooCommerce store
• Access to the WooCommerce/WordPress database, including customer orders, payment metadata (though not raw card numbers, which WooCommerce does not store directly), and admin credentials
• Web shell deployment enabling persistence, lateral movement into hosting infrastructure, or use of the compromised store as a launch point for further attacks
• Defacement or supply-chain tampering with product listings and checkout flow

Mitigation

1. Update to version 2.15.0 or later immediately — this is the only complete fix, since the flaw sits in core plugin logic rather than site configuration.
2. Audit the uploads directory for unexpected .php, .phtml, or other executable files disguised with image-like names, particularly anything written outside of normal customer order activity.
3. Restrict direct execution of PHP in upload directories at the web-server level (e.g., disabling PHP handlers in wp-content/uploads/) as a compensating control on any WooCommerce store, regardless of plugin patch status.
4. Review server access logs for unauthenticated requests to the plugin's upload/token endpoints around and before the September 21, 2026 disclosure date.

References

• NVD — CVE-2026-82187