Unauthenticated Arbitrary File Upload in JTL-Connector for WooCommerce

The JTL-Connector for WooCommerce plugin for WordPress contains a critical arbitrary file upload vulnerability, identified as CVE-2026-87855, affecting all versions up to and including 2.4.3. The flaw stems from the startSession() function, which incorrectly validates the jtlauth parameter, permitting unauthenticated sessions if the parameter is empty. Once a session is established, attackers can leverage the handleImagePush() function. This function fails to perform adequate file type validation, allowing for the upload of arbitrary files. By uploading a malicious script, such as a PHP web shell, an attacker can achieve remote code execution on the underlying web server. This vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its potential for total system compromise in affected WordPress environments.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code with the privileges of the web server user. This could lead to full site takeover, data exfiltration from the WooCommerce database, or the deployment of persistent backdoors within the WordPress environment. All WordPress sites running JTL-Connector for WooCommerce version 2.4.3 or older are considered at risk.

Recommendation

• Immediately update the JTL-Connector for WooCommerce plugin to the latest available version (greater than 2.4.3) once a patch is released by JTL-Software.
• Implement strict file upload filtering at the web application firewall (WAF) level to block requests containing suspicious file extensions or contents targeting plugin upload directories.
• Review web server access logs for anomalous POST requests to endpoints associated with the JTL-Connector, particularly those interacting with image upload functionalities.