guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress REST Endpoint main bftow_get_user_system_id tgId improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in guruteam Bot for Telegram Plugin up to 1.3.0. This affects the function bftow_get_user_system_id of the file /wp-json/woo-telegram/v1/main of the component REST Endpoint. Such manipulation of the argument tgId leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-109516. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in guruteam Bot for Telegram Plugin up to 1.3.0. It has been rated as critical. Affected by this issue is the function bftow_get_user_system_id of the file /wp-json/woo-telegram/v1/main of the component REST Endpoint. The manipulation of the argument tgId with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.

The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-109516 since 10/12/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/29/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-112584). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• guruteam

Name

• Bot for Telegram Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion