Bot For Telegram On Woocommerce
Monthly
Account takeover in the WooCommerce Telegram Bot plugin through version 1.3.0 allows unauthenticated remote attackers to obtain a persistent WordPress authenticated session for any user whose login name they know, including administrators. The plugin exposes a Telegram webhook REST route without authentication or signature checks and then issues a login cookie through a second unauthenticated endpoint, with the token derived from attacker-influenced values. No public exploit identified at time of analysis, but the priority is act_now because exploitation needs only the target username and the default plugin configuration.
Account takeover in the WooCommerce Telegram Bot plugin through version 1.3.0 allows unauthenticated remote attackers to obtain a persistent WordPress authenticated session for any user whose login name they know, including administrators. The plugin exposes a Telegram webhook REST route without authentication or signature checks and then issues a login cookie through a second unauthenticated endpoint, with the token derived from attacker-influenced values. No public exploit identified at time of analysis, but the priority is act_now because exploitation needs only the target username and the default plugin configuration.