CVE-2026-109516

{
  "etk_id": "ETK-2026-2934",
  "cve_id": "CVE-2026-109516",
  "display_id": "CVE-2026-109516",
  "ghsa_id": "GHSA-cw4f-j2mf-3wm9",
  "euvd_id": "EUVD-2026-112584",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Bot for Telegram on WooCommerce",
  "summary": "Bot for Telegram on WooCommerce versions through 1.3.0 allow unauthenticated attackers to obtain authenticated sessions for WordPress accounts, including administrator accounts. Exploitation requires the plugin's exposed functionality to be reachable and knowledge of a target account username.",
  "mitigation": "Disable and remove the plugin, or block public access to its plugin REST API functionality until a corrected release is available. No fixed version is recorded; review for unexpected account sessions and reset affected credentials if compromise is suspected.",
  "vendor": "guruteam",
  "product": "Bot for Telegram on WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Bot for Telegram on WooCommerce",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.015077666666666666,
  "t0_at": "2026-10-29T03:39:13.121000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-29T04:02:45.633224+00:00",
      "days": 0.01634852111111111,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:13.121000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-29T03:39:13.121000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:13.121000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109516"
    }
  }
}