CVE-2026-78193
HighCVSS 7.5Summary
The JTL-Connector for WooCommerce plugin for WordPress in versions up to and including 2.4.3 is vulnerable to time-based SQL Injection via the 'product.push' Identity Endpoint. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. The injection fires during identity linking before ProductController::push() executes, so exploitation succeeds even if downstream product handling would otherwise reject the request.
Risk Assessment
An attacker can extract sensitive data from the database, including customer, order, or credential information. The risk is high because exploitation requires no authentication and can lead to data leakage.
Recommendation
Update the JTL-Connector for WooCommerce plugin to a version later than 2.4.3 as soon as it becomes available. In the meantime, consider restricting access to the 'product.push' endpoint or disabling it.
Other vulnerabilities in JTL-Connector for WooCommerce
See all- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-9234Medium
The JTL-Connector for WooCommerce plugin up to version 2.4.1 has an authorization vulnerability. Missing capability checks and nonce verification in several admin actions allow authenticated attackers with Subscriber-level access or higher to modify plugin settings, download a ZIP archive of developer log files, and delete those files.
Original NVD description (English source)
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS