Time-Based SQL Injection in JTL-Connector for WooCommerce by WordPress

CVE-2026-78193

What is CVE-2026-78193?

The JTL-Connector for WooCommerce plugin for WordPress is susceptible to a time-based SQL Injection vulnerability via the 'product.push' Identity Endpoint. This issue arises from inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. Consequently, unauthenticated attackers can inject additional SQL queries into existing ones, enabling them to retrieve sensitive data from the database. The injection occurs during the identity linking process, allowing exploitation to succeed even if the request would usually be handled by downstream product checks.

References