ntbyk

Two vulnerabilities, CVE-2026-87855 and CVE-2026-78193, have been reported in the JTL-Connector for WooCommerce WordPress plugin, affecting all versions up to and including 2.4.3. One is an unauthenticated arbitrary file upload flaw that can lead to remote code execution, letting attackers run code on vulnerable sites. Security commentators are urging operators of affected shops to patch or disable the plugin until a fixed version is available.