Bot for Telegram on WooCommerce vulnerabilities

2 known vulnerabilities in Bot for Telegram on WooCommerce from Guruteam. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Bot for Telegram on WooCommerce: Improper Authentication

  CVE-2026-109516Oct 29, 2026Guruteam

  The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback

• 8.8 High severity

  Bot for Telegram on WooCommerce: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-9821Oct 12, 2024GuruteamEPSS 1.15%

  The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for