CVE-2026-87855: JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker can attempt exploitation without authentication or user interaction. The vulnerable session handling accepts an empty jtlauth parameter as valid, and the attack can be performed over the network.
What is the practical impact of successful exploitation?
An attacker may upload files that can be executable because file type validation is insufficient. This can enable remote code execution with the privileges available to the affected WordPress environment.
Which installations are affected?
JTL-Connector for WooCommerce versions up to and including 2.4.3 are affected. The provided information does not identify a required non-default configuration, so installations using an affected version should be treated as exposed.
How can defenders determine whether an installation may be vulnerable?
Check the installed JTL-Connector for WooCommerce version. Versions 2.4.3 and earlier should be considered potentially vulnerable.