CVE-2026-87855CWE-434unrestricted-file-upload

CVE-2026-87855

Critical · published October 14, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00790 · 55.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-10-14T08:18Z
References (5)
https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/src/Controllers/ImageController.php#L632 · [email protected]https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L424 · [email protected]https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L885 · [email protected]https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.3/vendor/jtl/connector/src/Application/Application.php#L955 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/ed869c1e-ae54-4db2-8147-39050a034c5e?source=cve · [email protected]
EPSS history
Timeline
  • 15 OCT 03:35Z
    EPSS moved — → 1%
    epss
  • 14 OCT 03:40Z
    JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
    cvelistv5
  • 14 OCT 03:40Z
    JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
    cvelistv5