CVE-2026-109516

Summary

The Bot for Telegram on WooCommerce plugin exposes an unauthenticated REST endpoint that accepts forged Telegram webhook updates without signature verification, allowing attackers to bypass authentication and log in as any WordPress user by supplying only their username and exploiting predictable token generation.

Exploitability

Exploitation is trivial for unauthenticated attackers since no authentication or authorization checks are required, and the attacker can forge the Telegram update with any WordPress username.

Blast radius

An attacker can fully compromise any affected site by taking over administrator accounts, leading to complete site takeover, data exfiltration, and further lateral movement.

Detection

Look for POST requests to /wp-json/woo-telegram/v1/main/ with non-standard or missing Telegram webhook signatures, especially those containing a 'message.chat.id' field matching known WordPress usernames; also monitor for subsequent requests to ?action=bftow_create_order&bftow_token= using tokens tied to unexpected user agents or timestamps near the Date header of the prior request.

Prioritized remediation

Upgrade to version 1.3.1 or later, which implements proper Telegram webhook signature verification and ownership proof before issuing login tokens.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.