JTL-Connector for WooCommerce: Unauthenticated arbitrary file upload

Summary

The JTL-Connector for WooCommerce WordPress plugin up to and including version 2.4.3 accepts an empty jtlauth parameter as valid credential in startSession(). Combined with insufficient file type validation in handleImagePush(), unauthenticated attackers can upload files via the saveImage() function. Uploaded files may be executable, which could enable remote code execution on the web server. The CNA record lists the vendor as 'ntbyk', but the code and fixes are published by JTL-Software.

Affected

• JTL-Connector for WooCommerce WordPress plugin, versions up to and including 2.4.3
• Default configuration: unaffected (per CNA record, no default-enabled state given)

Fixed in

• Fixed in 2.4.5 according to a German security article and a GitHub pull request. No JTL security advisory found, so this is not vendor-confirmed.
• Check the JTL changelog for the latest version before installing. A newer release (2.4.6) is mentioned but not confirmed.
• WordPress.org has closed the plugin, so the update must be installed manually.

Workaround

• Unknown. No vendor workaround found.
• Deactivate the plugin until a fixed version is installed.

Exploitation

• No in-the-wild exploitation or public proof of concept found at the time of research.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Check whether the plugin is installed and which version is running.
• Deactivate the plugin or restrict access to its endpoints until a fixed version is installed.
• Install the latest fixed version manually from the vendor and verify the version afterwards.
• Review the upload directories for unexpected or executable files and check web server logs for suspicious requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Wordfence threat intelligence entry www.wordfence.com
• Vulners CVE entry vulners.com
• WPScan vulnerability entry wpscan.com
• Dr. Web article on JTL connector security flaw (German) www.drweb.de
• JTL connector WooCommerce pull request 86 github.com
• JTL connector WooCommerce changelog github.com
• JTL connector WooCommerce repository github.com
• Vulnerable code: ImageController.php (2.4.3) plugins.trac.wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:03.