CVE-2026-9234

An authenticated attacker with at least Subscriber-level access can exploit this vulnerability. By sending specially crafted requests to specific AJAX actions or admin post requests, the attacker can bypass authorization checks. This allows them to modify plugin settings, download log files, or delete log files without possessing the necessary administrative privileges [ref_id=1]. The vulnerability affects the `admin_post_settings_save_woo-jtl-connector` action, as well as the `wp_ajax_downloadJTLLogs` and `wp_ajax_clearJTLLogs` AJAX actions [ref_id=1].

The vulnerability resides in the JTL-Connector for WooCommerce plugin. Specifically, it affects the `JtlConnectorAdmin::save()` method, which handles the `admin_post_settings_save_woo-jtl-connector` action, and the global functions `downloadJTLLogs()` and `clearJTLLogs()`, which are hooked to `wp_ajax_downloadJTLLogs` and `wp_ajax_clearJTLLogs` respectively [ref_id=1].

The patch is not provided in the bundle. However, the advisory indicates that the vulnerability is addressed by implementing proper capability checks and nonce verification for the affected actions. This ensures that only users with sufficient privileges can execute these sensitive operations, thereby mitigating the risk of unauthorized access and modification of plugin settings or log files.