ntbyk vulnerabilities

Products

• JTL-Connector for WooCommerce 3

Latest ntbyk CVEs

Newest publication first

1. CVE-2026-87855 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method

   Published 2026-10-14

   Critical·CVSS 9.8 EPSS 0.79%

   The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined...

2. CVE-2026-78193 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection

   Published 2026-10-14

   High·CVSS 7.5 EPSS 0.42%

   The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

3. CVE-2026-9234 JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions

   Published 2026-06-02

   Medium·CVSS 4.3 EPSS 0.20%

   The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnector...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.