Bot for Telegram on WooCommerce: critical auth bypass

What it is and who it affectsThe plugin Bot for Telegram on WooCommerce for WordPress is affected by a critical authentication bypass that can lead to...

What it is and who it affects

The plugin Bot for Telegram on WooCommerce for WordPress is affected by a critical authentication bypass that can lead to full account takeover. The vulnerability is tracked as CVE-2026-109516 and, according to the National Vulnerability Database (NVD) of NIST, affects all versions up to and including 1.3.0. It was published on 29 October 2026.

The flaw is classified as CWE-287 (improper authentication) and carries a CVSS 3.1 score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms: it can be reached over the network, needs no privileges and no user interaction, and compromises confidentiality, integrity and availability.

The root of the problem is the plugin's REST endpoint at /wp-json/woo-telegram/v1/main/, which is registered without any real authorisation check and does not verify the Telegram webhook signature. That allows an unauthenticated attacker to send a forged bot update whose chat identifier is set to any WordPress login name. The plugin then resolves that value to the targeted account without proving ownership, and writes a login token built from inputs the attacker controls or can predict within seconds. The resulting token can be redeemed at an endpoint that also lacks capability and nonce checks, and which issues a persistent authenticated session cookie for the targeted account.

In practice, anyone who knows a username — including an administrator's — can log in as that user. For an online shop in Barcelona, Lleida, Tarragona or Girona running WooCommerce, that means orders, customer data and payment configuration are all exposed.

Why it is urgent

At the time of writing, CVE-2026-109516 does not appear in CISA's KEV catalogue, so there is no public record that it is being exploited in the wild. That is not a reason to relax. A 9.8 score on an internet-facing endpoint with no authentication requirement is exactly the profile attackers scan for, and WordPress plugins are a favourite entry point precisely because they are often installed once and forgotten.

There is also a second reason for urgency: the flaw requires no special tooling. An attacker only needs the site's address and a valid username, and usernames are frequently discoverable through author archives, order confirmations or the REST API itself.

What to do today

Check whether the plugin is installed. Look in the WordPress plugin list and confirm the exact version. Any installation at 1.3.0 or below falls within the affected range.
Apply the fix indicated in the vendor's advisory. The NVD entry does not state which version corrects the issue, so consult the plugin's official notice and update to whatever release it specifies. If no update is available, deactivate the plugin until there is one.
Look for signs of intrusion. Review WordPress users for unexpected administrator accounts, check recent login activity and session records, and inspect access logs for requests to the plugin's REST endpoint or to the order-creation action with a token parameter.
Reduce what is exposed to the internet. Restrict access to the REST endpoint at web-server or firewall level where possible, and apply the principle of least privilege to all WordPress accounts.
Rotate credentials. If you find evidence of unauthorised access, reset passwords and invalidate active sessions, and review WooCommerce order and customer data for tampering.

How a cybersecurity team like ALMC's can help

Situations like this one are rarely isolated. A plugin with an unauthenticated endpoint is a symptom of a wider maintenance gap, and the same site usually carries outdated core files, weak server configuration and no monitoring. That is where a structured security approach pays off.

At ALMC we start by mapping what is actually installed and exposed: an audit of the WordPress, PrestaShop or Joomla installation, its plugins and its server, followed by pentesting to confirm which vulnerabilities are genuinely reachable from outside. From there we harden the server and the CMS, close the endpoints that should never have been public, and establish a patch routine so that advisories like this one are applied within hours rather than months.

We also monitor and respond to incidents. If a site has already been compromised, we clean it, remove backdoors, restore from a verified backup and trace how the entry happened so it does not repeat. For small IT teams and online shops across Catalonia, that combination of prevention, monitoring and response is usually the difference between a routine patch and a very expensive week.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.