IT SBIT Services
Schneeberger
DEEN
CVE tracker

Bot for Telegram on WooCommerce: Authentication bypass leading to account takeover

CVE-2026-109516Critical 9.8

← All vulnerabilities

Summary

The WordPress plugin Bot for Telegram on WooCommerce up to and including version 1.3.0 contains an unauthenticated REST endpoint that does not verify Telegram webhook signatures. An unauthenticated attacker can use it to obtain a login token and get a persistent session cookie for any WordPress account, including administrators, when the username is known. The attack requires no user interaction and is reachable over the network. CISA SSVC lists automatable: yes and technical impact: total.

Affected

  • Bot for Telegram on WooCommerce (WordPress plugin) all versions up to and including 1.3.0

Fixed in

  • Unknown. No fixed version or vendor advisory was found.

Workaround

  • Remove or deactivate the plugin. No other complete mitigation is known.
  • A web application firewall may block unauthenticated POST requests to REST paths containing woo-telegram; this is a stopgap and its effectiveness is not verified.

Exploitation

  • Not known to be exploited in the wild (OffSeq, as of 29 October 2026).
  • No public exploit code or Nuclei template found at the time of the check.
  • Not listed in CISA KEV according to a third-party tracker; the CISA catalogue was not checked directly.
  • EPSS 0.58 % as supplied; not independently verified.

Our recommendation

  • Remove or deactivate the plugin on all WordPress sites immediately.
  • Check for unexpected administrator accounts, recent logins and active sessions, and reset administrator passwords.
  • Invalidate all active sessions after removal.
  • Monitor web server logs for unauthenticated POST requests to /wp-json/woo-telegram/v1/main/.
  • Check the WordPress.org listing for a fix; the plugin is reported as closed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:11.

Original description (NVD)

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed