Unauthorized Access to Telegram Bot API Endpoint

CVE-2024-9628

What is CVE-2024-9628?

The WPS Telegram Chat plugin for WordPress contains a vulnerability that exposes the application to unauthorized data modification and potential data loss. This issue arises from a missing capability check in the 'Wps_Telegram_Chat_Admin::check?onnection' function, affecting all versions up to and including 4.5.4. Authenticated attackers with subscriber-level access or higher can leverage this vulnerability to gain full access to the Telegram Bot API endpoint, enabling them to manipulate data without appropriate permissions.

References