CVE-2026-9234
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The JTL-Connector for WooCommerce plugin up to version 2.4.1 has an authorization vulnerability. Missing capability checks and nonce verification in several admin actions allow authenticated attackers with Subscriber-level access or higher to modify plugin settings, download a ZIP archive of developer log files, and delete those files.
Risk Assessment
An attacker can change plugin configuration, disrupting store operations, and access sensitive developer log files that may contain system information.
Recommendation
Immediately update the JTL-Connector plugin to the latest version. Restrict access to the WordPress admin panel to trusted users only.
Other vulnerabilities in JTL-Connector for WooCommerce
See all- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-78193High
The JTL-Connector for WooCommerce plugin for WordPress in versions up to and including 2.4.3 is vulnerable to time-based SQL Injection via the 'product.push' Identity Endpoint. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. The injection fires during identity linking before ProductController::push() executes, so exploitation succeeds even if downstream product handling would otherwise reject the request.
Original NVD description (English source)
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnectorAdmin::save()) and on the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX actions (handled by the global downloadJTLLogs() and clearJTLLogs() functions). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings, download a ZIP archive of the connector's developer log files, and delete those log files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS