CVE-2026-87855

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-434

Impact

Unauthenticated attackers can achieve remote code execution on the web server over the network. They achieve this by bypassing authentication and uploading executable files.

Root cause

The startSession() function treats an empty jtlauth parameter as valid authentication, and handleImagePush() fails to validate uploaded file types.

Affected systems

JTL-Connector for WooCommerce plugin for WordPress up to and including 2.4.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the JTL-Connector for WooCommerce plugin to a version newer than 2.4.3 once available, or deactivate the plugin immediately until patched.

shell

$ wp plugin deactivate woo-jtl-connector

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-87855