CVE-2026-87855 and CVE-2026-78193 affect the JTL-Connector for WooCommerce WordPress plugin from ntbyk, all versions up to and including 2.4.3. CVE-2026-87855 is an unauthenticated arbitrary file upload that can lead to remote code execution. CVE-2026-78193 is an unauthenticated SQL injection. No fixed version is listed. https://www.cve.org/CVERecord?id=CVE-2026-87855 #CVE #infosec #cybersecurity