Unauthorized Access to Telegram Bot API Endpoint
CVE-2024-9628

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
WPs Telegram Chat
Vendor
CVE Published:
25 October 2024

Summary

The WPS Telegram Chat plugin for WordPress contains a vulnerability that exposes the application to unauthorized data modification and potential data loss. This issue arises from a missing capability check in the 'Wps_Telegram_Chat_Admin::check?onnection' function, affecting all versions up to and including 4.5.4. Authenticated attackers with subscriber-level access or higher can leverage this vulnerability to gain full access to the Telegram Bot API endpoint, enabling them to manipulate data without appropriate permissions.

Affected Version(s)

WPS Telegram Chat * <= 4.5.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wps-telegram-c...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

István Márton
.