Unauthenticated Access to Telegram Bot API Messages Possible Through Version 4.5.4

CVE-2024-9630
5.4MEDIUM

Key Information

Vendor
WPsolution
Status
WPs Telegram Chat
Vendor
CVE Published:
25 October 2024

Summary

The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.

Affected Version(s)

WPS Telegram Chat <= 4.5.4

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Disclosed

  • Vulnerability Reserved.

  • Discovered

  • Vendor Notified

Collectors

NVD DatabaseMitre Database

Credit

István Márton
.