{"id":"CVE-2026-87855","published":"2026-10-14T04:18:52.840","lastModified":"2026-10-14T15:17:26.197","description":"The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/src/Controllers/ImageController.php#L632","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L424","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L885","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L955","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed869c1e-ae54-4db2-8147-39050a034c5e?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The JTL-Connector plugin allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, due to weak authentication and insufficient file validation. This vulnerability can lead to remote code execution on affected WordPress sites.","exploitability":"Exploitation is straightforward for unauthenticated attackers who can trigger the saveImage() function, requiring no valid credentials or complex setup beyond accessing the vulnerable endpoint.","blast_radius":"The vulnerability affects all versions up to 2.4.3, making it widespread across many WordPress installations that use this plugin, with potential for complete system compromise through RCE.","remediation":"Upgrade to version 2.4.4 or later to remediate the Arbitrary File Upload vulnerability in the JTL-Connector plugin.","detection":"Monitor for unusual file upload activity in the wp-content/uploads directory, particularly executable files (.php, .jsp, .asp) being written without authentication, and check web server logs for requests to the saveImage endpoint with suspicious file extensions.","tags":["rce","file-upload","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:53:32.595Z"}}