Live › vulnerability › CVE-2026-109516
The Bot for Telegram on WooCommerce plugin for WordPress, in all versions up to and including 1.3.0, has a REST endpoint that accepts forged Telegram bot updates without verifying them. An unauthenticated attacker who knows a WordPress username can obtain a login token and receive a persistent authenticated session cookie for that account, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:41 UTC. All times on this page are UTC.
Any WordPress site with the Bot for Telegram on WooCommerce plugin at version 1.3.0 or earlier is exposed, because the REST endpoint is open to unauthenticated requests and performs no webhook signature check. Sites without this plugin installed are not affected. The sources do not say whether a non-default configuration is required.
No product ranges from the sources yet.
Bot for Telegram on WooCommerce is installed and its version in the WordPress plugins list, or with wp plugin get <plugin-slug> --field=version using WP-CLI./wp-json/woo-telegram/v1/main/ on the site.1.3.0 (the sources do not name a fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this attacker-supplied value to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftow_create_order&bftow_token= endpoint, which calls wp_set_auth_cookie() unconditionally via login_user_by_id, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.
This page as .md · .json · in your agent: get_signal("CVE-2026-109516")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.