{"id":"CVE-2026-109516","kind":"vulnerability","aliases":["CVE-2026-109516"],"related":[],"title":"WordPress Telegram WooCommerce plugin lets anyone log in as any user","description":"The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.","summary":"The Bot for Telegram on WooCommerce plugin for WordPress, in all versions up to and including 1.3.0, has a REST endpoint that accepts forged Telegram bot updates without verifying them. An unauthenticated attacker who knows a WordPress username can obtain a login token and receive a persistent authenticated session cookie for that account, including administrators.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","telegram","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the plugin `Bot for Telegram on WooCommerce` is installed and its version in the WordPress plugins list, or with `wp plugin get <plugin-slug> --field=version` using WP-CLI.\n- Look for the REST route `/wp-json/woo-telegram/v1/main/` on the site.","fix":"- Bot for Telegram on WooCommerce: versions after `1.3.0` (the sources do not name a fixed version).","status":"open","published_at":"2026-10-29T04:18:22+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","triaged_at":"2026-10-29T04:42:59+00:00","updated_at":"2026-10-29T04:42:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T04:42:59Z","model":"claude-haiku-5-5","output":{"fix":"- Bot for Telegram on WooCommerce: versions after `1.3.0` (the sources do not name a fixed version).","reach":"internet","title":"WordPress Telegram WooCommerce plugin lets anyone log in as any user","impact":"high","summary":"The Bot for Telegram on WooCommerce plugin for WordPress, in all versions up to and including 1.3.0, has a REST endpoint that accepts forged Telegram bot updates without verifying them. An unauthenticated attacker who knows a WordPress username can obtain a login token and receive a persistent authenticated session cookie for that account, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","telegram","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gets persistent admin session cookie, full site takeover.","analyst_note":"Confirm the fixed version and whether a patched release exists; the sources do not name one.","how_to_check":"- Check whether the plugin `Bot for Telegram on WooCommerce` is installed and its version in the WordPress plugins list, or with `wp plugin get <plugin-slug> --field=version` using WP-CLI.\n- Look for the REST route `/wp-json/woo-telegram/v1/main/` on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site with the Bot for Telegram on WooCommerce plugin at version 1.3.0 or earlier is exposed, because the REST endpoint is open to unauthenticated requests and performs no webhook signature check. Sites without this plugin installed are not affected. The sources do not say whether a non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000779,"input_tokens":4483,"output_tokens":661,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-109516':14A,17A '-2026':13A,16A '/wp-json/woo-telegram/v1/main':107C '1.3.0':41B,105C 'accept':47B 'account':77B,96C,157C,243C 'action':215C 'administr':79B,262C 'agent':179C 'allow':124C 'anyon':6A 'attack':57B,127C,151C,186C,246C,253C 'attacker-control':185C 'attacker-suppli':150C 'auth':226C 'authent':72B,92C,237C 'bftow':143C,216C,219C 'bot':26B,50B,81C,132C 'bound':189C 'bypass':93C 'call':223C 'callback':114C 'capability-check-fre':207C 'capabl':208C 'check':209C 'comput':173C 'control':187C 'cooki':74B,227C,239C 'creat':217C 'cve':12A,15A 'date':197C 'endpoint':45B,109C,221C 'forg':48B,131C 'free':210C 'fulli':184C 'get':144C,159C 'given':263C 'header':198C 'host':21B 'http':177C 'id':147C,233C 'includ':40B,78B,104C,261C 'input':182C 'issu':234C 'know':59B 'lead':94C 'less':214C 'let':5A 'log':7A,255C 'login':66B,141C,162C,171C,230C 'make':248C 'md5':175C 'message.chat.id':136C 'name':142C 'nonc':213C 'nonce-less':212C 'obtain':64B 'order':218C 'ownership':166C 'packag':18B 'perform':118C 'permiss':113C 'persist':71B,236C 'plugin':4A,31B,86C 'possibl':250C 'post':129C 'proof':167C 'receiv':69B 'redeem':203C 'regist':111C 'resolv':148C 'respons':194C 'rest':44B,108C 'result':200C 'return':115C 'second':191C 'self':20B 'self-host':19B 'server':176C 'session':73B,238C 'set':137C,225C 'signatur':122C 'suppli':152C 'system':146C 'takeov':97C 'target':156C,242C 'telegram':2A,22B,28B,49B,83C,120C 'tgid':163C 'time':180C 'token':67B,172C,201C,220C 'true':116C 'unauthent':56B,126C,206C,252C 'uncondit':228C 'updat':51B,133C 'use':192C 'user':11A,145C,160C,178C,231C,260C,266C 'usernam':62B,268C 'valu':153C 'verif':123C 'verifi':53B 'version':36B,100C 'via':158C,229C 'vulner':90C 'webhook':121C 'within':190C 'without':52B 'woocommerc':3A,23B,30B,85C 'wordpress':1A,24B,33B,61B,88C,140C,259C 'wp':224C 'write':169C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the Bot for Telegram on WooCommerce plugin at version 1.3.0 or earlier is exposed, because the REST endpoint is open to unauthenticated requests and performs no webhook signature check. Sites without this plugin installed are not affected. The sources do not say whether a non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T04:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109516","severity":null,"published_at":"2026-10-29T04:18:22+00:00","modified_at":"2026-10-29T04:18:22+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","fetched_at":"2026-10-29T04:41:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}