The JTL-Connector for WooCommerce plugin suffers from missing authorization (CWE-862) in versions up to 2.4.1. Specifically, the admin_post_settings_save_woo-jtl-connector action and the AJAX actions wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs lack proper capability checks and nonce verification. This flaw enables authenticated users with low privileges (Subscriber-level and above) to perform unauthorized actions such as changing plugin settings, downloading a ZIP archive of developer logs, and deleting those logs. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and impacting integrity but not confidentiality or availability.

An attacker with at least Subscriber-level access can modify plugin settings, potentially altering plugin behavior without proper authorization. They can also download sensitive developer log files and delete them, which may hinder troubleshooting or forensic analysis. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to the affected plugin. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for an official patch or temporary workaround.