CVE-2026-78193 in JTL-Connector for WooCommerce Plugin
Summary
by MITRE • 10/14/2026
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The JTL-Connector for WooCommerce plugin, a widely utilized integration tool within the WordPress ecosystem that facilitates synchronization between e-commerce platforms and inventory management systems, contains a critical security flaw identified as a time-based SQL injection vulnerability. This specific weakness resides in the product.push Identity Endpoint and affects all versions up to and including 2.4.3. The root cause of this vulnerability is insufficient input sanitization combined with a lack of proper query preparation mechanisms when handling user-supplied parameters. In secure software development, inputs from external sources must be strictly validated and escaped before being incorporated into database queries to prevent malicious code injection. However, in the affected versions of JTL-Connector, the application fails to adequately escape these inputs or utilize parameterized queries, leaving a direct pathway for attackers to manipulate the underlying SQL logic.
The technical nature of this flaw allows unauthenticated actors to exploit the vulnerability by appending additional SQL commands to existing database queries. Because the injection is time-based, it relies on inducing measurable delays in query execution times rather than relying on error messages or visible data output, which makes detection more difficult for standard logging mechanisms and automated scanners that do not monitor response latency closely. This technique enables attackers to extract sensitive information from the WordPress database incrementally by observing how long specific queries take to complete. The attacker can craft payloads that trigger conditional delays based on true or false conditions within the SQL statement, effectively allowing them to read data character by character without triggering immediate application errors or blocks.
A particularly dangerous aspect of this vulnerability is its operational timing during the identity linking process. The injection point fires before the ProductController::push() method executes, which means that even if downstream logic would normally reject a malformed product request due to validation rules, the SQL injection occurs earlier in the processing pipeline. This architectural positioning ensures that exploitation succeeds regardless of whether the subsequent business logic deems the input valid or invalid for standard e-commerce operations. Consequently, an attacker does not need to bypass complex application-level validations related to product data structures; they only need to target the identity linking endpoint where the database interaction occurs without proper safeguards.
The impact of this vulnerability is severe, as it grants unauthenticated attackers full read access to the WordPress database contents. This can lead to the exposure of sensitive user credentials, session tokens, configuration details containing API keys or database connection strings, and other proprietary business data stored within the site's tables. The ability to extract such information compromises not only the integrity of the specific WooCommerce store but potentially the broader network if shared credentials are used elsewhere. From a classification perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, and maps to MITRE ATT&CK techniques related to Database Query Injection and Data Exfiltration via Non-Application Layer Protocols or Application Layer protocols depending on the specific exploitation vector.
To mitigate this risk, administrators must immediately update the JTL-Connector for WooCommerce plugin to a version newer than 2.4.3 where these input handling issues have been resolved through proper parameterization of SQL queries and rigorous input validation. Until an upgrade is feasible, implementing Web Application Firewall rules that detect time-based blind injection patterns can provide some level of protection by blocking requests with suspicious query structures or abnormal latency indicators. Additionally, reviewing database access logs for unusual timing anomalies may help in identifying ongoing exploitation attempts. It is also recommended to enforce strict network segmentation and limit direct database access from web-facing applications where possible, adhering to the principle of least privilege to minimize the blast radius should a vulnerability be exploited in other components.