The JTL‑Connector for WooCommerce plugin is vulnerable to a time‑based SQL Injection via the 'product.push' Identity Endpoint in all versions up to 2.4.3. Unsanitized user input is incorporated into SQL statements, allowing an attacker to inject and execute arbitrary queries. The flaw is triggered before ProductController::push() runs, so the attack succeeds even if downstream product handling would otherwise reject the request. This is a CWE‑89 vulnerability and permits extraction of sensitive database information by unauthenticated users, posing a significant threat to data confidentiality.

All installations of the JTL‑Connector for WooCommerce plugin distributed by ntbyk, from any source and up to version 2.4.3, are impacted. No specific build or configuration details are available beyond the version threshold of 2.4.3.

The CVSS score of 7.5 signals high severity. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack route is through network access to the public 'product.push' endpoint, which accepts unauthenticated requests. An attacker can send crafted requests, observe timing behavior, and iterate to retrieve database data. Because the vector is unauthenticated and widely reachable, the risk remains substantial even with low exploitation probability.