Zero Radar
← feed
CriticalVulnerabilityCVE-2026-109516updated 29 Oct 2026, 07:45 UTC

Bot for Telegram on WooCommerce WordPress plugin lets anyone log in as any user

A flaw in this WordPress plugin lets an outsider take over any user account, including site administrators, just by knowing the username. The attacker can then fully control the website.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends forged updateFake Telegram message to open REST endpoint
  2. 2Plugin trusts inputNo webhook signature check
  3. 3Username maps to accountAny login name, including admins
  4. 4Login token issuedBuilt from User-Agent and time
  5. 5Token redeemed for cookieNo nonce or capability check
  6. ResultAttacker logs in as any user

What happened

The plugin's Telegram REST endpoint accepts forged bot updates without signature verification, maps an attacker-chosen login name to a WordPress account, and issues a login token derived from attacker-controlled User-Agent and time, which is redeemable for an authenticated session cookie.

Why it is dangerous: Unauthenticated attackers can gain administrator-level access to WooCommerce stores, exposing customer data, payment-related settings, and the ability to change or deface the site.

Are you affected?

You are affected if you run the Bot for Telegram on WooCommerce plugin for WordPress in version 1.3.0 or earlier.

Bot for Telegram on WooCommerce (WordPress plugin), all versions up to and including 1.3.0

What to do

  1. Check whether the Bot for Telegram on WooCommerce plugin is installed and what version it is
  2. Deactivate or remove the plugin until a fixed version is confirmed from the vendor
  3. Review user accounts and admin logins for unexpected activity, and reset administrator passwords
  4. Watch for updates from the plugin vendor or the GitHub advisory and install the fixed version when available

Timeline

  1. 29 Oct 2026, 04:18 UTC
    Publicly disclosed
  2. 29 Oct 2026, 04:18 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 04:20 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 07:45 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-109516 · GHSA-cw4f-j2mf-3wm9
CVSS
9.8 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
29 Oct 2026, 04:18 UTC
On Zero Radar
29 Oct 2026, 04:20 UTC (3 min after disclosure)
Last change
29 Oct 2026, 07:45 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Bot for Telegram on WooCommerce WordPress plugin lets anyone log in as any user · Zero Radar