---
id: "CVE-2026-109516"
kind: "vulnerability"
aliases: ["CVE-2026-109516"]
title: "WordPress Telegram WooCommerce plugin lets anyone log in as any user"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "telegram", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T04:18:22+00:00"
first_seen_at: "2026-10-29T04:41:58+00:00"
updated_at: "2026-10-29T04:42:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109516", "first_seen_at": "2026-10-29T04:41:58+00:00"}]
---

# WordPress Telegram WooCommerce plugin lets anyone log in as any user

The Bot for Telegram on WooCommerce plugin for WordPress, in all versions up to and including 1.3.0, has a REST endpoint that accepts forged Telegram bot updates without verifying them. An unauthenticated attacker who knows a WordPress username can obtain a login token and receive a persistent authenticated session cookie for that account, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the plugin `Bot for Telegram on WooCommerce` is installed and its version in the WordPress plugins list, or with `wp plugin get <plugin-slug> --field=version` using WP-CLI.
- Look for the REST route `/wp-json/woo-telegram/v1/main/` on the site.

## Fix

- Bot for Telegram on WooCommerce: versions after `1.3.0` (the sources do not name a fixed version).

## Timeline

- 2026-10-29T04:41:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109516

## From the sources

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_