Bot for Telegram on WooCommerce: Authentication bypass and account takeover (CVE-2026-109516)

CVE-2026-109516 affects the 'Bot for Telegram on WooCommerce' plugin for WordPress versions 1.3.0 and earlier. The plugin fails to verify Telegram webhook signatures and incorrectly trusts attacker-supplied input within its REST API and order creation actions, leading to full authentication bypass and privilege escalation.

Attack Chain

1. Attacker sends a forged HTTP POST request to the /wp-json/woo-telegram/v1/main/ endpoint.
2. The endpoint, lacking a permission callback, accepts the request.
3. The attacker provides a message.chat.id field set to the target user's login username.
4. The bftow_get_user_system_id() function retrieves the victim's user ID via get_user_by('login', $tgId) without proof of identity.
5. The attacker calculates a session token based on their User-Agent and the current time().
6. The attacker invokes the ?action=bftow_create_order&bftow_token= endpoint with the crafted token.
7. The plugin calls wp_set_auth_cookie() using the victim's ID, granting the attacker a persistent authenticated session.

Impact

Successful exploitation allows unauthenticated attackers to gain persistent administrative access to the WordPress site, enabling full account takeover.

Recommendation

1. Disable or uninstall the 'Bot for Telegram on WooCommerce' plugin immediately if not currently using a patched version.
2. Review web server access logs for anomalous POST requests to /wp-json/woo-telegram/v1/main/ and GET/POST requests containing action=bftow_create_order.
3. Audit WordPress user accounts for suspicious activities or unauthorized password/email changes occurring after the deployment of the vulnerable plugin version.