Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnectorAdmin::save()) and on the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX actions (handled by the global downloadJTLLogs() and clearJTLLogs() functions). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings, download a ZIP archive of the connector's developer log files, and delete those log files.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-9234 Missing Authorization in JTL-Connector for WooCommerce Plugin Up to 2.4.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9234
Post summary
The post announces CVE-2026-9234, a missing authorization flaw in JTL-Connector for WooCommerce Plugin versions up to 2.4.1, with no PoC, exploit, or patch details provided.