The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload file [truncated]
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'product.push' Identity Endpoint in versions up to and including 2.4.3. This vulnerability allows attackers to append additional SQL queries to existing ones, potentially leading to sensitive information extraction from the database. The vulnerability is confirmed in versions up to and including 2 [truncated]
