PT-2026-45711 · WordPress · Putler Connector For Woocommerce
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
JTL-Connector for WooCommerce versions prior to 2.4.2
Description
The plugin contains missing authorization due to a lack of capability checks and nonce verification. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin settings, download a ZIP archive of developer log files, and delete those logs. The issue affects the 'admin post settings save woo-jtl-connector' action handled by the
save() function in JtlConnectorAdmin, as well as the 'wp ajax downloadJTLLogs' and 'wp ajax clearJTLLogs' AJAX actions handled by the downloadJTLLogs() and clearJTLLogs() functions.Recommendations
Update the plugin to version 2.4.2 or later.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Putler Connector For Woocommerce