CVE-2026-109516: Account takeover via WooCommerce plugin
This text was generated using artificial intelligence (AI).CVE-2026-109516 affects the WordPress plugin Bot for Telegram on WooCommerce by guruteam. The vulnerability allows unauthenticated attackers to take over existing WordPress accounts. All versions up to and including 1.3.0.
According to Wordfence Intelligence, the vulnerability has a CVSS score of 9.8 rated. The published CVSS string indicates network access, low attack complexity, and no required privileges and user interaction.
The documented attack path begins at the REST endpoint /wp-json/woo-telegram/v1/main/. A permissions check is registered for this endpoint, which allows requests. Furthermore, there is no verification of a Telegram webhook signature.
This allows an unauthenticated request to submit a manipulated bot update. The contained identifier can be resolved as a WordPress username. The plugin then generates a login token.
This token can be used via another unauthenticated endpoint. A WordPress login session is set for the resolved account. According to the technical documentation, this can affect any WordPress account if its username is known, including administrative accounts.
As of now, there is no evidence of active exploitation in the wild (as of: 2026-10-29).
Affected and Immediate Actions
Organizations should check whether the plugin Bot for Telegram on WooCommerce is used on WordPress instances and whether the version in use falls within the affected range.
As of 2026-10-29, no patched release is available. Plugin deactivation remains the primary mitigation measure. Additional interim measures are outlined in the following recommendations for action:
Disable the plugin.
Block the REST endpoint /wp-json/woo-telegram/v1/main/ at the network level.
Monitor WordPress audit logs for unauthenticated POSTrequests to /wp-json/woo-telegram/v1/main/ Check.
Audit logs on GET-requests with the parameter bftow_token Check.
Prioritize and mitigate affected systems.
Once a fixed release is published, a patched version should be updated.
Relevance for externally accessible WordPress instances
The plugin is operated under the domain of an organization and exposes the affected REST endpoint externally. Externally accessible WordPress instances, plugin signatures, and the existence of the endpoint may be relevant for the assessment of affected assets.
For prioritization, in addition to the use of the plugin, the external accessibility of the instance is also relevant. Systems with administrative WordPress accounts are particularly vulnerable, as the documented vulnerability may allow a login as an existing user.
Organizations in Germany subject to NIS-2 or KRITIS obligations should check for reporting requirements under Art. 33 GDPR (72-hour deadline) in the event of exploitation. Austrian operators check relevant obligations under the NISG; Swiss organizations refer to reporting obligations under the amended ISG regarding the BACS.
External asset visibility for prioritization
LocateRisk supports the visibility of externally accessible systems and deployed software. In this vulnerability, external detection of WordPress instances and plugin signatures can help categorize potentially affected assets for further technical review.
The platform makes exposure and deployed software visible – including unmanaged or forgotten instances that may not be captured in the regular asset inventory. The concrete review of the patch status and assessment of potential impact remain necessary.
Am I affected?
This affects Bot for Telegram on WooCommerce in the versions mentioned above. Those wanting to know if Bot for Telegram on WooCommerce is visible in their own externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
The vulnerability allows unauthenticated attackers to log in as any WordPress user – including administrative accounts – provided the respective username is known. This is done by abusing a publicly accessible REST endpoint of the plugin, which performs neither an access check nor a webhook signature validation.
All versions of the plugin are affected Bot for Telegram on WooCommerce up to and including 1.3.0. As of October 29, 2026, no patched release is available. It is recommended to disable the plugin until a fixed release is published.
Immediate measures include the deactivation of the plugin and the blocking of the endpoint /wp-json/woo-telegram/v1/main/ at the network level. Additionally, audit logs on unauthenticated POST requests to this endpoint and GET requests with the parameter bftow_token should be checked.
Status: October 29, 2026. This article is for informational purposes only and is not legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always authoritative. Despite thorough research, we assume no liability for the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-109516
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français