CVE-2026-87855 is a critical (CVSS 9.8) flaw in the JTL-Connector for WooCommerce WordPress plugin that lets unauthenticated attackers upload files that may be executable, which makes remote code execution possible.
What Is It
CVE-2026-87855 is an arbitrary file upload vulnerability (CWE-434) in the JTL-Connector for WooCommerce plugin for WordPress. The NVD record says it comes from two weaknesses working together:
- Authentication bypass: The
startSession()function accepts an emptyjtlauthparameter as a valid credential. - Weak file validation: The
handleImagePush()function does not check file types closely enough.
Together, these let an attacker reach the saveImage() function without logging in and upload files that may be executable on the server. Wordfence reported the issue, and NVD published it on 2026-10-14. NVD lists its status as "Received".
Why It Matters
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means the flaw can be exploited over the network, attack complexity is low, and the attacker needs no privileges and no user interaction. Confidentiality, integrity and availability impacts are all rated high.
An attacker who uploads an executable file to a WordPress server could run code on that server. This plugin connects WooCommerce stores to JTL, so affected sites are likely to be online stores.
Exploitation status: None of the sources cited below report active exploitation of this CVE. Still, the attack path needs no authentication and has low complexity, which makes this flaw a likely target.
What's Vulnerable
- Vendor: ntbyk
- Product: JTL-Connector for WooCommerce (WordPress plugin, slug
woo-jtl-connector) - Affected versions: All versions up to and including 2.4.3
The NVD record references vulnerable code in version 2.4.3 at src/Controllers/ImageController.php and vendor/jtl/connector/src/Application/Application.php.
Patch Status
The NVD record does not name a fixed version. Administrators should:
- Find any WordPress site running JTL-Connector for WooCommerce version 2.4.3 or earlier.
- Check the Wordfence advisory and the WordPress plugin repository for a patched release, and update as soon as one is available.
- If no fix is available, consider disabling the plugin until one is released.
Sources
- NVD, CVE-2026-87855
- Wordfence Threat Intel; JTL-Connector for WooCommerce advisory
- WordPress Plugin Trac; ImageController.php (v2.4.3, L632)
- WordPress Plugin Trac; Application.php (v2.4.3, L424)
- WordPress Plugin Trac; Application.php (v2.4.3, L885)
- WordPress Plugin Trac; Application.php (v2.4.3, L955)