{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ajtl-softwarejtl-connector_for_woocommercewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jtl-software:jtl-connector_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-87855"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["JTL-Connector for WooCommerce (\u003c= 2.4.3)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","wordpress","rce","cve-2026-87855"],"_cs_type":"advisory","_cs_vendors":["JTL-Software"],"content_html":"\u003cp\u003eThe JTL-Connector for WooCommerce plugin for WordPress contains a critical arbitrary file upload vulnerability, identified as CVE-2026-87855, affecting all versions up to and including 2.4.3. The flaw stems from the \u003ccode\u003estartSession()\u003c/code\u003e function, which incorrectly validates the \u003ccode\u003ejtlauth\u003c/code\u003e parameter, permitting unauthenticated sessions if the parameter is empty. Once a session is established, attackers can leverage the \u003ccode\u003ehandleImagePush()\u003c/code\u003e function. This function fails to perform adequate file type validation, allowing for the upload of arbitrary files. By uploading a malicious script, such as a PHP web shell, an attacker can achieve remote code execution on the underlying web server. This vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its potential for total system compromise in affected WordPress environments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary code with the privileges of the web server user. This could lead to full site takeover, data exfiltration from the WooCommerce database, or the deployment of persistent backdoors within the WordPress environment. All WordPress sites running JTL-Connector for WooCommerce version 2.4.3 or older are considered at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the JTL-Connector for WooCommerce plugin to the latest available version (greater than 2.4.3) once a patch is released by JTL-Software.\u003c/li\u003e\n\u003cli\u003eImplement strict file upload filtering at the web application firewall (WAF) level to block requests containing suspicious file extensions or contents targeting plugin upload directories.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous \u003ccode\u003ePOST\u003c/code\u003e requests to endpoints associated with the JTL-Connector, particularly those interacting with image upload functionalities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:35:58Z","date_published":"2026-10-14T04:35:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jtl-woocommerce-rce/","summary":"The JTL-Connector for WooCommerce WordPress plugin is vulnerable to unauthenticated remote code execution via a flaw in session handling and file validation.","title":"Unauthenticated Arbitrary File Upload in JTL-Connector for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-10-jtl-woocommerce-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:jtl-Software:jtl-Connector_for_woocommerce:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}