CVE-2026-87855: JTL-Connector WooCommerce Plugin RCE Vulnerability

CVE-2026-87855 Overview

The JTL-Connector for WooCommerce plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 2.4.3. The flaw resides in the saveImage() function within ImageController.php. The startSession() function accepts an empty jtlauth parameter as a valid credential, and handleImagePush() performs insufficient file type validation. Unauthenticated attackers can upload executable files, which enables remote code execution on affected WordPress sites. The weakness is classified as [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Unauthenticated attackers can achieve remote code execution on WordPress sites running vulnerable versions of the JTL-Connector for WooCommerce plugin.

Affected Products

JTL-Connector for WooCommerce plugin for WordPress
All versions up to and including 2.4.3
WordPress sites running WooCommerce with this connector installed

Discovery Timeline

2026-10-14 - CVE CVE-2026-87855 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-87855

Vulnerability Analysis

The vulnerability chains two distinct weaknesses in the plugin's image handling pipeline. The startSession() function in the connector's Application.php treats an empty jtlauth parameter as a valid authentication token. This allows unauthenticated requests to reach privileged endpoints normally reserved for authenticated JTL ERP synchronization.

Once an attacker bypasses authentication, the saveImage() function in ImageController.php forwards the uploaded file to handleImagePush(). This handler fails to enforce proper MIME type or extension validation. As a result, attackers can upload PHP files or other executable payloads to the WordPress uploads directory.

The uploaded files remain accessible through the web server. Attackers can then request the uploaded script directly, triggering arbitrary PHP execution under the web server user context.

Root Cause

The root cause is an authentication bypass combined with missing file type validation. The connector's session initialization logic does not reject empty credentials, and the image upload handler does not restrict uploads to image MIME types or safe extensions. These two defects produce an unauthenticated remote code execution path.

Attack Vector

Exploitation requires only network access to the vulnerable WordPress instance. The attacker sends a crafted request to the connector endpoint with an empty jtlauth parameter and a malicious file payload. No user interaction or prior authentication is needed. See the vulnerable code in ImageController.php and the authentication logic in Application.php line 424.

No verified proof-of-concept code is published. See the Wordfence Vulnerability Intelligence Report for additional technical context.

Detection Methods for CVE-2026-87855

Indicators of Compromise

Unexpected PHP, PHAR, or executable files in the WordPress wp-content/uploads/ directory, particularly subpaths used by the JTL connector
HTTP POST requests to connector endpoints containing an empty jtlauth parameter
Outbound network connections initiated by the web server process to unfamiliar hosts following upload activity
New or unexpected administrator accounts and modified wp-config.php or theme files

Detection Strategies

Inspect web server access logs for POST requests targeting the JTL connector image endpoints with missing or empty authentication tokens
Scan the uploads directory for files whose extensions do not match standard image formats (.php, .phtml, .phar, .html)
Correlate upload events with immediate subsequent GET requests to the same uploaded file path, a pattern consistent with webshell execution

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and the plugin directory
Forward web server and PHP-FPM logs to a centralized logging platform for anomaly detection
Alert on process spawns from the web server account that invoke shells, package managers, or network utilities

How to Mitigate CVE-2026-87855

Immediate Actions Required

Disable or uninstall the JTL-Connector for WooCommerce plugin until a patched version is confirmed installed
Audit the wp-content/uploads/ directory for unauthorized files and remove any suspicious payloads
Rotate WordPress administrator credentials, API keys, and database passwords after confirming the host is clean
Review all WordPress user accounts and remove any that were not provisioned by administrators

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 2.4.3. Monitor the official plugin listing on the WordPress.org plugin directory and the Wordfence Vulnerability Intelligence Report for an updated release addressing both the authentication bypass and file type validation defects.

Workarounds

Restrict access to the connector endpoints using web server access controls or a web application firewall rule that blocks requests with empty jtlauth parameters
Configure the web server to deny PHP execution within the WordPress uploads directory using directory-level handler restrictions
Limit inbound access to the WordPress admin and connector endpoints to known JTL ERP source IP addresses

bash

# Apache: deny PHP execution in uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx equivalent for server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}