CVE-2026-109516

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this attacker-supplied value to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftow_create_order&bftow_token= endpoint, which calls wp_set_auth_cookie() unconditionally via login_user_by_id, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this attacker-supplied value to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftow_create_order&bftow_token= endpoint, which calls wp_set_auth_cookie() unconditionally via login_user_by_id, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this attacker-supplied value to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftow_create_order&bftow_token= endpoint, which calls wp_set_auth_cookie() unconditionally via login_user_by_id, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this attacker-supplied value to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftow_create_order&bftow_token= endpoint, which calls wp_set_auth_cookie() unconditionally via login_user_by_id, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.