{"id":"CVE-2026-109516","published":"2026-10-29T04:18:22.763","lastModified":"2026-10-29T04:18:22.763","description":"The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L91","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L98","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L149","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L44","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L62","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_WooCommerce.php#L42","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b73e0-c154-4bc4-90bc-0929053b77b0?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Bot for Telegram on WooCommerce plugin exposes an unauthenticated REST endpoint that accepts forged Telegram webhook updates without signature verification, allowing attackers to bypass authentication and log in as any WordPress user by supplying only their username and exploiting predictable token generation.","exploitability":"Exploitation is trivial for unauthenticated attackers since no authentication or authorization checks are required, and the attacker can forge the Telegram update with any WordPress username.","blast_radius":"An attacker can fully compromise any affected site by taking over administrator accounts, leading to complete site takeover, data exfiltration, and further lateral movement.","remediation":"Upgrade to version 1.3.1 or later, which implements proper Telegram webhook signature verification and ownership proof before issuing login tokens.","detection":"Look for POST requests to /wp-json/woo-telegram/v1/main/ with non-standard or missing Telegram webhook signatures, especially those containing a 'message.chat.id' field matching known WordPress usernames; also monitor for subsequent requests to ?action=bftow_create_order&bftow_token= using tokens tied to unexpected user agents or timestamps near the Date header of the prior request.","tags":["auth-bypass","rest-api","account-takeover","telegram","wordpress","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:42:35.284Z"}}