Bot for Telegram on WooCommerce: Unauthenticated Webhook Forgery to Admin Takeover

Threat Overview

A critical authentication bypass vulnerability in the Bot for Telegram on WooCommerce (bot-for-telegram-on-woocommerce) WordPress plugin allows unauthenticated remote attackers to take over any administrator account on an affected e-commerce storefront knowing only the target’s username.

Tracked as CVE-2026-109516 (CVSS 9.8), the flaw affects all versions up to and including 1.3.0. By chaining an unprotected REST webhook endpoint with a predictable token generator and an unauthenticated login action, attackers can issue themselves persistent administrator session cookies in seconds.

The Breakdown: How the Exploit Works

The exploit chains three architectural failures. First, the plugin registers its REST webhook endpoint (/wp-json/woo-telegram/v1/main/) with permission_callback => '__return_true' and performs zero signature verification to confirm requests originate from Telegram.

Second, when an unauthenticated attacker sends a forged payload with message.chat.id set to a target WordPress login name, bftow_get_user_system_id() resolves that string via get_user_by('login', $tgId) without proving ownership. It then writes a login token using md5($_SERVER['HTTP_USER_AGENT'] . time())—combining the attacker’s User-Agent header with the Unix timestamp exposed in the server’s HTTP Date header. Finally, the attacker redeems that predictable MD5 hash at ?action=bftow_create_order, which unconditionally calls wp_set_auth_cookie() and logs the attacker in as the administrator.

The Operational Risk: What an Attacker Gains

• Two-Request Admin Takeover: Any attacker who knows an administrator username can forge a webhook, compute the MD5 token locally, and log in as the store owner.
• E-Commerce Payment & Order Hijacking: Full WooCommerce admin access enables attackers to redirect payouts, issue fraudulent refunds, or inject checkout skimmers.
• Complete Customer PII Exfiltration: Names, billing addresses, email lists, and order histories stored in the WordPress database are exposed.
• Server-Level Persistence: Attackers can use administrator privileges to upload web shells via the plugin installer and establish permanent host backdoors.

Our Take in Plain English

“This is a textbook example of why bolting convenience plugins onto an e-commerce database is so dangerous. The developer left the front door unlocked (__return_true), trusted anyone claiming to be Telegram without checking a signature, and generated login tokens out of the visitor’s browser name and the current clock time. An attacker only needs your username and the time of day to become the store administrator. Decoupling your public storefront onto a modern pre-rendered edge architecture removes public WordPress REST endpoints and PHP cookie-minting hooks from the internet entirely.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Exposes public /wp-json/ REST routes where third-party plugins can bypass core authentication and mint administrator sessions.
• Modern Pre-Rendered Edge Architecture: Serves storefronts and marketing pages as static, pre-compiled edge assets with zero public PHP endpoints or database session hooks.

Immediate Action Items for WordPress Operators

1. Remove or Patch Immediately: Deactivate and uninstall Bot for Telegram on WooCommerce (1.3.0 and prior) unless a verified patched version is installed.
2. Block the Vulnerable REST Route: Add a WAF rule blocking requests to /wp-json/woo-telegram/v1/main/ and query strings containing action=bftow_create_order.
3. Purge User Meta & Sessions: Force-logout all administrator accounts and delete residual bftow_token entries from wp_usermeta.
4. Audit WooCommerce Gateways: Verify that payment processor API keys, webhook URLs, and administrator accounts have not been modified.