CVE-2026-109516

{
  "etk_id": "ETK-2026-2934",
  "cve_id": "CVE-2026-109516",
  "display_id": "CVE-2026-109516",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-112584",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Bot for Telegram on WooCommerce",
  "summary": "Bot for Telegram on WooCommerce versions through 1.3.0 permit unauthenticated account impersonation. An attacker who knows a WordPress username may obtain a session as that user, including an administrator, when the vulnerable plugin is active.",
  "mitigation": "Deactivate and remove Bot for Telegram on WooCommerce until an updated release is available. Restrict public access to the affected WordPress site or its relevant endpoints if immediate removal is not possible.",
  "vendor": "guruteam",
  "product": "Bot for Telegram on WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Bot for Telegram on WooCommerce",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.2370408,
  "t0_at": "2026-10-29T03:39:13.121000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-29T04:02:45.633224+00:00",
      "days": 0.01634852111111111,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:13.121000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-29T03:39:13.121000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:13.121000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109516"
    }
  }
}