--- title: "CVE-2026-109516: WooCommerce Bot for Telegram - Authentication Bypass" description: "WooCommerce Bot for Telegram WordPress plugin <= 1.3.0 contains an authentication bypass caused by missing permission checks and webhook signature verification in REST endpoints, letting unauthenticated attackers take over accounts by forging bot updates with arbitrary usernames." url: https://panop.io/threat-heartbeat/CVE-2026-109516/ --- # CVE-2026-109516 WooCommerce Bot for Telegram - Authentication Bypass WooCommerce Bot for Telegram WordPress plugin <= 1.3.0 contains an authentication bypass caused by missing permission checks and webhook signature verification in REST endpoints, letting unauthenticated attackers take over accounts by forging bot updates with arbitrary usernames. CVSS base score 9.8 /10 Critical CISA KEV Not listed Public exploit None known Authentication Not required [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-109516) ## Details Type Authentication Bypass Impact Broken Authentication CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Published 29 October 2026 Updated 29 October 2026 Weakness [CWE-287](https://cwe.mitre.org/data/definitions/287.html) ## Vendor fix Update to a version later than 1.3.0 or apply vendor patches addressing authentication checks and webhook verification. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-109516](https://nvd.nist.gov/vuln/detail/CVE-2026-109516) - [https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW\_User.php#L62](https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L62) - [https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW\_WooCommerce.php#L42](https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_WooCommerce.php#L42) - [https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b73e0-c154-4bc4-90bc-0929053b77b0?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b73e0-c154-4bc4-90bc-0929053b77b0?source=cve) - [https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW\_Telegram.php#L91](https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L91) - [https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW\_Telegram.php#L98](https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L98) - [https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW\_User.php#L149](https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L149) - [https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW\_User.php#L44](https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L44) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)