CVE-2026-87855

CVSS: 9.8v3.1CriticalDeferred

Published 2026-10-14Last modified 2026-10-14

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (cve.org)

EPSS score

0.79%

0%100%

Low · Change unavailable

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

2026-10-14
PublishedVulnerability first disclosed.
2026-10-14
Last modifiedVulnerability information updated.

Description

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVSS metrics

3 scores · 3 sources · 1 version

v3.19.8

EPSS trend

Probability

0.79%

Chance of exploitation in the next 30 days

Percentile

55%

Versus all other CVEs

30-day change

Change unavailable

2026-10-142026-10-14

EPSS score

0.79%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected systems

Ntbyk1 product

jtl-connector for woocommerce≤ 2.4.3

Wordpress1 product

woo-jtl-connector≤ 2.4.3

2 vendors · 2 products

References

6 links