CVE-2026-109516: Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-29 · updated 2026-10-29
Weakness: CWE-287

Description

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

Summary

The Bot for Telegram on WooCommerce plugin for WordPress (all versions up to and including 1.3.0) has an unauthenticated authentication bypass in its REST endpoint, which lacks webhook signature verification and accepts attacker-supplied login names to mint predictable login tokens. An unauthenticated attacker can forge a Telegram update and redeem the resulting token to obtain an authenticated session cookie for any WordPress account, including administrators, given only the username. CVSS is 9.8 critical; it is not listed in CISA KEV. Update the plugin beyond 1.3.0 if a fixed release is available, or disable/remove the plugin until then.

تعاني إضافة Bot for Telegram on WooCommerce لـ WordPress (جميع الإصدارات حتى 1.3.0 включительно) من تجاوز للمصادقة دون الحاجة إلى تسجيل الدخول عبر نقطة REST التي تفتقر إلى التحقق من توقيع webhook وتقبل أسماء تسجيل دخول يقدمها المهاجم لتوليد رموز دخول قابلة للتنبؤ. يمكن لمهاجم غير مصادق تزوير تحديث Telegram واستخدام الرمز الناتج للحصول على كوكي جلسة مصادق عليها لأي حساب WordPress، بما في ذلك المديرين، بمعرفة اسم المستخدم فقط. درجة CVSS هي 9.8 حرجة، ولم تُدرج في CISA KEV. حدّث الإضافة إلى إصدار أحدث من 1.3.0 إن توفر إصدار مُصلح، أو عطّل الإضافة أو أزلها حتى ذلك الحين.

Affected products

guruteam Bot for Telegram on WooCommerce: through 1.3.0

References

Get alerted when CVE-2026-109516 or the next vulnerability affects your stack