Arbitrary File Upload Vulnerability in JTL-Connector for WooCommerce Plugin by WordPress
CVE-2026-87855

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Jtl-connector For WooCommerce
Vendor
CVE Published:
14 October 2026

What is CVE-2026-87855?

The JTL-Connector for WooCommerce plugin is compromised by a vulnerability that permits arbitrary file uploads due to insufficient validation in the saveImage() function. By exploiting the startSession() function, which erroneously allows an empty jtlauth parameter, unauthenticated users can upload potentially harmful files. This flaw could lead to remote code execution, putting WordPress sites at significant risk. It is crucial for users to assess their versions and implement necessary security measures.

Affected Version(s)

JTL-Connector for WooCommerce 0 <= 2.4.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/woo-jtl-connec...
https://plugins.trac.wordpress.org/browser/woo-jtl-connec...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S. (m3ez)
.