CVE-2026-109516: Unauthenticated Account Takeover in Bot for Telegram on WooCommerce (CVSS 9.8)

CVE-2026-109516: Critical Authentication Bypass in a WooCommerce Telegram Plugin

A critical authentication bypass has been disclosed in the Bot for Telegram on WooCommerce WordPress plugin. Tracked as CVE-2026-109516 with a CVSS 3.1 score of 9.8, the flaw lets an unauthenticated remote attacker take over WordPress user accounts. It affects all versions up to and including 1.3.0.

WPScan lists no known fix, and the plugin is marked closed in the WordPress.org directory. The practical remediation is to remove it.

Vulnerability Overview

Technical Analysis

The plugin registers the REST route /wp-json/woo-telegram/v1/main/ with permission_callback => '__return_true', meaning WordPress performs no authorization check before the handler runs. The handler also never verifies that incoming requests really come from Telegram, because webhook signatures are not validated.

According to the Wordfence advisory title, an attacker can chain a fake Telegram webhook with a brute-forced login token to authenticate as an existing user. VulDB associates the issue with the tgId argument handled by bftow_get_user_system_id.

Exploitation requires no account, no interaction from a victim, and only network access to the site's REST API.

Exploitation Status

OffSeq reports no confirmed exploitation, and the CVE is not in CISA KEV as of publication. Because the plugin is abandoned and the attack path is simple, expect scanning for it to begin quickly.

Remediation

There is no patched release. Recommended actions:

# Check whether the plugin is installed and its version
wp plugin list --name=bot-for-telegram-on-woocommerce --fields=name,status,version
 
# Deactivate and remove it
wp plugin deactivate bot-for-telegram-on-woocommerce
wp plugin delete bot-for-telegram-on-woocommerce

1. Deactivate and delete the plugin; replace it with a maintained Telegram notification integration if needed.
2. Block the route at your WAF or reverse proxy if removal is not immediately possible: deny requests to /wp-json/woo-telegram/.
3. Review administrator and shop-manager accounts for unexpected logins or new users.
4. Reset passwords and invalidate sessions for privileged users on any site that ran the plugin while exposed.

Detection

grep "woo-telegram/v1/main" /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head

A high volume of requests to this route from a single IP suggests token brute-forcing.

Key Takeaways

1. CVE-2026-109516 is a CVSS 9.8 unauthenticated account takeover in a WooCommerce Telegram plugin.
2. No patch exists; the plugin appears abandoned, so removal is the fix.
3. Missing permission_callback checks on REST routes remain a common source of critical WordPress plugin flaws.
4. WooCommerce stores hold customer and order data, so a takeover of an admin account has high business impact.

Sources

• CVE-2026-109516 — NIST NVD
• CVE-2026-109516 — VulDB
• Bot for Telegram on WooCommerce — WPScan