CVE-2026-109516: Admin Account Takeover in WordPress Bot

CVE-2026-109516 is a critical authentication vulnerability in the WordPress Bot for Telegram on WooCommerce plugin, versions up to 1.3.0. A REST endpoint is unprotected by authorization checks or Telegram webhook signature verification. An unauthenticated attacker can send a forged request with any WordPress username, including an administrator, and compromise the target account.

The system resolves the username to an account without verifying request legitimacy and generates a login token from data controlled by the attacker. The token is redeemable at an unprotected endpoint that issues a persistent authenticated session cookie, allowing full access to the compromised account.

The CVSS score is 9.8 (critical): the highest impact on confidentiality, integrity, and availability. The vulnerability was published by the National Vulnerability Database on 29 October 2026 and reported on public channels on 30 October 2026. No verified public exploit data is available, but the mechanism is direct and immediately exploitable.

WordPress system administrators must immediately verify which version of the Bot for Telegram on WooCommerce plugin is installed. If version 1.3.0 or earlier is present, updating to a later version is a priority. If no update is available, temporarily disable the plugin until an official patch is released. Check WordPress access logs for unauthorized sessions on administrator accounts.