CVE-2026-109516

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass…

Risk score: 64/100
CVSS: 9.8 v3.1
Published: 29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The Bot for Telegram on WooCommerce plugin for WordPress has a critical vulnerability (CVSS 9.8) allowing an unauthenticated attacker to bypass authentication and take over any WordPress account, due to missing Telegram webhook signature verification and insecure token generation.
Affected: {'products': ['WordPress'], 'packages': ['Bot for Telegram on WooCommerce plugin'], 'versions': ['all versions up to and including 1.3.0']}
Fix: Check the linked advisory for the concrete fix, but as a mitigation, consider disabling the plugin or upgrading to a fixed version.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

Original description

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

Last activity 29 Oct 2026. Patch Forecast updates every hour.