Unauthenticated Access to Telegram Bot API Messages Possible Through Version 4.5.4

CVE-2024-9630

Summary

The WPS Telegram Chat plugin for WordPress contains a vulnerability that allows unauthorized users to bypass authentication checks. This issue arises from a missing capability verification when accessing messages sent via the Telegram Bot API. As a result, unauthenticated attackers can view sensitive messages, posing a significant risk to privacy and security for users of versions up to and including 4.5.4. It is essential for website administrators to take immediate action to secure their WordPress installations and update the plugin to prevent potential data exposure.

References