Unauthenticated arbitrary file upload in JTL-Connector for WooCommerce
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload in all versions up to and including 2.4.3 via the saveImage() function. The startSession() function accepts an empty jtlauth parameter as a valid credential, and handleImagePush() performs insufficient file type validation (CWE-434). Unauthenticated attackers can upload files that may be executable, which makes remote code execution possible.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for JTL-Connector for WooCommerce.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-14 Threatist record created from CVE-2026-87855
- 2026-10-14 Alias added: GHSA-7mjr-phqx-8hgq
- 2026-10-14 CISA SSVC decision points changed
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ed869c1e-ae54-4db2-8147-39050a034c5e?source=cve
- https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L885
- https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/src/Controllers/ImageController.php#L632
- https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L424
- https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L955
More ntbyk vulnerabilities
- TI-2026-73757 Unauthenticated SQL injection in JTL-Connector for WooCommerce CVSS 3.1HIGH 7.5
- TI-2026-08115 Missing authorization in ntbyk JTL-Connector for WooCommerce CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-87855 · CVE Program
- CVE-2026-87855 · NVD
- FIRST EPSS
- GHSA-7mjr-phqx-8hgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences