The vulnerability allows an attacker to upload arbitrary files through the image.push method without authentication. The issue stems from the startSession() function accepting an empty jtlauth parameter combined with insufficient file type validation in handleImagePush(), enabling the upload of executable content. This flaw can lead directly to remote code execution on the affected host. The weakness is classified as CWE-434, an arbitrary file upload flaw.

The vulnerability affects the JTL-Connector for WooCommerce plugin for WordPress, specifically all released versions up to and including 2.4.3. Systems running any of these versions are susceptible unless the plugin has been upgraded beyond 2.4.3.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is less than 1%, reflecting a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. The most likely attack vector is an unauthenticated HTTP request to the image.push endpoint, after which an attacker can upload a file with an executable MIME type, leading to remote code execution.