CVE-2026-87855: JTL-Connector for WooCommerce Arbitrary File Upload

Overview

A critical arbitrary file upload vulnerability has been disclosed in JTL-Connector for WooCommerce, a WordPress plugin used to synchronize WooCommerce stores with the JTL ERP/warehouse platform. Tracked as CVE-2026-87855, the flaw allows a completely unauthenticated remote attacker to upload arbitrary files — including executable PHP webshells — to a vulnerable site, leading directly to remote code execution (RCE).

The vulnerability is rated CVSS 9.8 (Critical) and affects all plugin versions up to and including 2.4.3. It was assigned by Wordfence, discovered 2026-08-18, and publicly disclosed 2026-10-13, with the CVE record published 2026-10-14. As of this writing no patched version has been confirmed by the vendor (ntbyk).

Technical Details

Field	Value
CVE ID	CVE-2026-87855
Severity	Critical (9.8)
Attack Vector	Network
Authentication	None Required
Privileges Required	None
User Interaction	None
Impact	Unauthenticated arbitrary file upload → Webshell RCE

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type)

How It Works

The root cause is a chained auth-bypass-plus-validation failure spanning two parts of the plugin's connector core:

Auth bypass via empty credential. The plugin's session handshake, startSession() (in the bundled JTL Connector core, Application.php, around lines 424, 885, and 955), is responsible for validating the jtlauth token sent by a client before granting it a connector session. The function treats an empty jtlauth parameter as a valid credential rather than rejecting it — meaning any request that simply omits or blanks the token is treated as authenticated. This is a classic "empty value passes the check" logic flaw: the code likely checks something equivalent to "does the supplied token match the stored token (or is it empty)?" instead of strictly requiring a non-empty, matching secret.
Insufficient file validation on upload. Once a session is established — trivially, via the empty-token bypass — the attacker can reach saveImage() and handleImagePush() in ImageController.php (around line 632). These functions accept image data (intended for product image sync between JTL and WooCommerce) and write it to disk, but perform insufficient file-type and extension validation. Because the upload path doesn't strictly enforce an image-only allowlist (by verified content type and a safe, fixed extension) before writing the file into a web-accessible directory, an attacker can submit a file with PHP (or other executable) content and have it saved with an executable extension.

Chained together, this means an attacker needs zero credentials and zero user interaction: send a request with an empty jtlauth value to pass startSession(), then call saveImage() with a malicious payload disguised as an "image" to drop a webshell directly onto the server.

Impact Assessment

Who Is At Risk

Any WordPress/WooCommerce site running JTL-Connector for WooCommerce version 2.4.3 or earlier with the plugin active and reachable over the network is vulnerable. This includes:

WooCommerce stores integrating with JTL-Wawi (JTL's ERP/warehouse management) for product, image, and order sync
Multi-site or agency-managed WooCommerce installs where the connector endpoint is exposed on the public internet
Any site where the plugin is installed but not actively used — an inactive integration does not reduce exposure if the plugin files remain active

Potential Attack Chains

Unauthenticated Session Establishment — Attacker sends a request to the connector endpoint with an empty jtlauth parameter; startSession() accepts it as valid.
Malicious "Image" Upload — Attacker calls saveImage() / handleImagePush() with a crafted payload (e.g. a .php file disguised as an image upload), which is written to a web-accessible path due to insufficient file-type validation.
Webshell Execution — Attacker requests the uploaded file directly via HTTP, triggering execution in the context of the web server user.
Full Site Compromise / RCE — From webshell access, the attacker can read wp-config.php (database credentials), create rogue admin accounts, pivot to other sites on shared hosting, or use the compromised store to serve malware, skim payment data, or stage further attacks.

Mitigation

Immediate Actions

No vendor patch is confirmed available as of publication. Until ntbyk ships a fixed version, deactivate and remove JTL-Connector for WooCommerce on any site where it is not in active, essential use.
If the integration cannot be disabled, restrict network access to the connector endpoint (e.g. IP allowlist the JTL-Wawi server address at the firewall/WAF level) so arbitrary internet hosts cannot reach startSession().
Audit the uploads directory and plugin's image-handling paths for unexpected PHP, .phtml, .phar, or other executable files written outside of normal media uploads.
Rotate WordPress credentials and API keys (database, JTL integration tokens, any stored secrets) if compromise is suspected.
Monitor the plugin's WordPress.org changelog and ntbyk/JTL vendor channels for a fixed release, and update immediately once available.

Detection Opportunities

Web server access logs showing POST requests to the connector/image-push endpoint with an empty or missing jtlauth parameter
Newly created files with executable extensions (.php, .phtml, .phar, etc.) inside directories normally reserved for image uploads
Outbound requests immediately following an upload, consistent with webshell "first contact" (file listing, whoami-style recon commands)
Unexpected new WordPress administrator accounts or modified wp-config.php timestamps

Defence-in-Depth

Run a Web Application Firewall (WAF) rule set that blocks uploads of executable file types regardless of application-level validation
Enforce PHP execution restrictions in upload/media directories (e.g. via web server config denying .php execution under wp-content/uploads/)
Apply the principle of least privilege to the web server user so a webshell cannot trivially pivot beyond the web root
Maintain an allowlist-based plugin inventory and regularly audit installed plugins for integrations that are no longer actively used

Background

JTL-Connector plugins bridge WooCommerce (and other e-commerce platforms) with JTL-Wawi, a widely used German ERP/warehouse management system, to synchronize products, images, orders, and stock levels. Because connector plugins like this one are designed to accept automated, machine-to-machine traffic (not just human logins), authentication bugs in their session-handshake logic are especially dangerous — they remove the one barrier standing between the public internet and a direct file-write primitive.

Unauthenticated arbitrary file upload vulnerabilities are consistently among the most severe WordPress plugin flaws because they skip credential theft or privilege escalation entirely and go straight to code execution. Given the CVSS 9.8 rating, the pre-auth nature of the bug, and the fact disclosure (2026-10-13) preceded any confirmed patch, defenders should treat exploitation attempts as imminent and prioritize remediation accordingly.