Authentication Bypass in WooCommerce Bot for Telegram Plugin by WordPress

CVE-2026-109516

What is CVE-2026-109516?

The Bot for Telegram on WooCommerce plugin for WordPress contains a vulnerability that allows unauthenticated attackers to bypass authentication processes, leading to account takeover. The vulnerability arises due to the improper registration of a REST endpoint that lacks the necessary permission checks and Telegram webhook signature verification. This allows an attacker to submit a forged bot update targeting any WordPress user by manipulating the login name. By exploiting this flaw, attackers can receive a login token that grants them persistent access to the affected accounts without any authorization or validation processes. As a result, unauthorized individuals can gain administrative access if they know the username of a WordPress user.

References