WooCommerce JTL-Connector CVE-2026-78193

Exploitation requires the JTL-Connector for WooCommerce plugin (version ≤2.4.3) to be installed and active, with its JTL connector Identity/'product.push' endpoint network-reachable - this is the plugin's normal operating mode for syncing with JTL ERP software, so it is effectively the default for any site using the connector. No authentication, no user interaction, and no special non-default configuration are required (CVSS PR:N/UI:N), and the injection triggers during identity linking before product-handling validation, so downstream request rejection does not limit it. The principal limiting factor is deployment scope: only sites that have deliberately installed this JTL-WooCommerce bridge are affected, which is a narrow population compared to generic WooCommerce installs. Impact is confined to data disclosure via blind/time-based inference, which is slower than direct extraction but still fully automatable.

This is a credible, high-priority issue for affected sites despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) is internally consistent with the description: an unauthenticated, network-reachable, low-complexity blind SQL injection yielding confidentiality impact only, which correctly explains why the score is 7.5 (HIGH) rather than CRITICAL - integrity and availability are not affected because the flaw enables data extraction, not modification or destruction. The key risk-elevating factor beyond raw CVSS is that the injection fires during identity linking (IdentityLinker/PrimaryKeyMapper) BEFORE ProductController::push() executes, so downstream validation cannot neutralize it - exploitation succeeds even against requests that product handling would reject. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no quantitative exploitation-probability signal and no SSVC decision data; this means active-exploitation status cannot be asserted. The signals do not conflict - they are simply incomplete. Net: a real, actionable confidentiality risk (credential hashes, API keys, PII, order data are all reachable via blind extraction), tempered by the fact that the affected product is a specialized ERP-integration plugin rather than a ubiquitous component, which naturally limits mass-scanning attractiveness.

An unauthenticated attacker sends a crafted request to the JTL-Connector's exposed Identity/'product.push' endpoint with a malicious value in the identity-linking parameter. Because the primary-key mapping query is built without sufficient escaping or preparation, the attacker injects a time-based blind SQL payload that, through boolean/timing differentials, lets them enumerate and exfiltrate database contents such as user records and secrets. No public exploit code was identified in the provided data, but the vulnerability is network-reachable with low complexity and no authentication.