WordPress plugin
Bot for Telegram on WooCommerce security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High1
- Medium1
- Low0
All Bot for Telegram on WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token ≤1.3.0No patch available | CVE-2026-109516 | |
| High8.8 | Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass ≤1.2.7No patch available | CVE-2024-9821 |
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
≤1.3.0No patch available
- High8.8Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass
≤1.2.7No patch available
Bot for Telegram on WooCommerce: common questions
Does Bot for Telegram on WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Bot for Telegram on WooCommerce: 1 critical, 1 high, 1 medium. At least one is not fixed in the latest version.
How do I check which version of Bot for Telegram on WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Bot for Telegram on WooCommerce vulnerability?
CVE-2026-109516, published Oct 28, 2026: Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token. Severity: Critical (CVSS 9.8).
Is any Bot for Telegram on WooCommerce vulnerability listed in CISA KEV?
No. None of the known Bot for Telegram on WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.