CVE-2026-87855
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
ntbyk JTL-Connector for WooCommerce
CVSS
9.8CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.79%Chance of exploitation activity in the next 30 days, higher than 55% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Description
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Text from CVE List
Affected versions 1
- JTL-Connector for WooCommerceaffected: all versions through 2.4.3CVE List
References 5
- wordfence.com/threat-intel/vulnerabilities/id/ed869c1e-ae54-4db2-8147-39050a034c5e?source=cveReferencevia CVE List
- plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L885Referencevia CVE List
- plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/src/Controllers/ImageController.php#L632Referencevia CVE List
- plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L424Referencevia CVE List
- plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L955Referencevia CVE List