WooCommerce Telegram Bot CVE-2026-109516

The target site must have the Bot for Telegram on WooCommerce plugin (version ≤1.3.0) installed and active. Exploitation requires no authentication, no user interaction, and works against the default configuration because the /wp-json/woo-telegram/v1/main/ endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification. The single concrete prerequisite is that the attacker must supply the exact WordPress login name of the account to be taken over (set as message.chat.id), since bftow_get_user_system_id() resolves it via get_user_by('login', $tgId) with no ownership proof; admin usernames are often enumerable, so this is a weak limiting factor. The derived token md5($_SERVER['HTTP_USER_AGENT'] . time()) is fully attacker-controlled or bounded within seconds via the response Date header, imposing no meaningful timing barrier, and the redemption endpoint (?action=bftow_create_order&bftow_token=) is unauthenticated, nonce-less, and capability-check-free.

The signals are strongly concordant toward high priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remotely reachable, unauthenticated, low-complexity flaw with full confidentiality, integrity, and availability impact, and the described mechanism supports every one of those metrics: an open REST endpoint (permission_callback => '__return_true') with no webhook signature check lets an attacker forge a Telegram update, resolve any login name via get_user_by('login', ...), and redeem a weakly derived md5($_SERVER['HTTP_USER_AGENT'] . time()) token to obtain a full authenticated session cookie for any account including administrators. The vuln.today decision label is act_now and the finding is reported by Wordfence, which corroborates the severity. No public exploit is identified at time of analysis (the references are the Wordfence advisory and wordpress.org source-code lines, not exploit code), and the plugin is not listed in CISA KEV. EPSS is not supplied, so probabilistic exploitation likelihood cannot be weighed; this absence is a genuine data gap rather than a low score. The only non-trivial precondition - knowing the target's WordPress username - is weak, since admin usernames are frequently enumerable, so this is a real priority rather than a high-CVSS-but-low-real-risk issue, but the realistic blast radius is bounded by the plugin's niche deployment footprint.

An unauthenticated attacker who knows (or enumerates) an administrator's WordPress username sends a crafted POST to /wp-json/woo-telegram/v1/main/ carrying a forged bot update whose message.chat.id is that username, causing the plugin to mint a login token derived from md5(User-Agent + time()) - both values the attacker controls or can bound to within seconds using the HTTP response's own Date header. The attacker then redeems that token at the nonce-less, capability-check-free ?action=bftow_create_order&bftow_token= endpoint, which calls wp_set_auth_cookie() and returns a persistent authenticated session cookie for the targeted admin account. No public exploit code is identified at time of analysis, though the advisory describes the full chain in detail.