JTL-Connector EUVD-2026-100800

No special conditions beyond having the JTL-Connector for WooCommerce plugin (version 2.4.3 or earlier) installed and active on an internet-reachable WordPress site - remote unauthenticated exploitation works against default configurations because startSession() treats an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required. The primary limiting factor is deployment scope: exploitation requires the specific JTL-Connector plugin to be present (a niche ERP integration), and the attacker must be able to reach the plugin's connector/image-push endpoint over the network. Successful RCE further assumes the web server executes uploaded PHP from the writable upload path, which is the default on typical WordPress hosts.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: a remote, unauthenticated attacker can exploit it with low complexity and no user interaction, and the C:H/I:H/A:H impact is justified because arbitrary file upload leading to code execution grants full control of the WordPress host. The root cause described - startSession() accepting an empty jtlauth parameter as valid credentials, combined with missing file-type validation in handleImagePush()/saveImage() - is an authentication-bypass-plus-unrestricted-upload chain (CWE-434), the most reliably weaponizable class of WordPress plugin flaw. No EPSS score, KEV listing, or public POC was provided in the input, so there is currently 'no public exploit identified at time of analysis'; the absence of these signals lowers the IMMEDIATE urgency somewhat but does not reduce the technical severity, and file-upload-to-RCE bugs in WordPress plugins are historically rapidly weaponized once disclosed. The one tempering factor is deployment footprint: this is a niche ERP-integration plugin, so widespread opportunistic mass-exploitation is less likely than for a ubiquitous plugin, but any exposed instance should be treated as critical.

A remote, unauthenticated attacker sends a crafted request to the plugin's JTL-Connector endpoint with an empty jtlauth parameter, which startSession() wrongly accepts as valid, then abuses the image-push/saveImage() flow to upload a PHP file because handleImagePush() does not properly validate the file type. The attacker then requests the uploaded file directly to execute arbitrary code and take over the WordPress site. No public exploit was identified at time of analysis, but the described flaw is low-complexity and highly reliable.