---
id: CVE-2026-87855
title: >-
  The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to
  Arbitrary File Upload in all versions up to, and including, 2.4.3 via the
  saveImage() function
summary: >-
  The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to
  Arbitrary File Upload in all versions up to, and including, 2.4.3 via the
  saveImage() function. This is due to the startSession() function accepting an
  empty jtlauth…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T04:18:52.840'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87855'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/src/Controllers/ImageController.php#L632
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L424
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L885
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L955
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/ed869c1e-ae54-4db2-8147-39050a034c5e?source=cve
    label: security@wordfence.com
tags:
  - nvd
ingestedAt: '2026-10-14T05:14:27.656Z'
---

## Overview

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.