CVE-2026-87855

Summary

The JTL-Connector plugin allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, due to weak authentication and insufficient file validation. This vulnerability can lead to remote code execution on affected WordPress sites.

Exploitability

Exploitation is straightforward for unauthenticated attackers who can trigger the saveImage() function, requiring no valid credentials or complex setup beyond accessing the vulnerable endpoint.

Blast radius

The vulnerability affects all versions up to 2.4.3, making it widespread across many WordPress installations that use this plugin, with potential for complete system compromise through RCE.

Detection

Monitor for unusual file upload activity in the wp-content/uploads directory, particularly executable files (.php, .jsp, .asp) being written without authentication, and check web server logs for requests to the saveImage endpoint with suspicious file extensions.

Prioritized remediation

Upgrade to version 2.4.4 or later to remediate the Arbitrary File Upload vulnerability in the JTL-Connector plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.