CVE-2026-87855
CriticalCVSS 9.8Summary
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
Risk Assessment
An attacker can upload a malicious executable file to the server, potentially leading to full compromise of the WordPress site and server.
Recommendation
Update the JTL-Connector plugin to the latest patched version. If possible, restrict access to the file upload functionality.
Other vulnerabilities in JTL-Connector for WooCommerce
See all- CVE-2026-78193High
The JTL-Connector for WooCommerce plugin for WordPress in versions up to and including 2.4.3 is vulnerable to time-based SQL Injection via the 'product.push' Identity Endpoint. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. The injection fires during identity linking before ProductController::push() executes, so exploitation succeeds even if downstream product handling would otherwise reject the request.
- CVE-2026-9234Medium
The JTL-Connector for WooCommerce plugin up to version 2.4.1 has an authorization vulnerability. Missing capability checks and nonce verification in several admin actions allow authenticated attackers with Subscriber-level access or higher to modify plugin settings, download a ZIP archive of developer log files, and delete those files.
Original NVD description (English source)
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS