CVE-2024-9627 is a vulnerability in the TeploBot – Telegram Bot for WP plugin for WordPress, affecting all versions up to and including 1.3. The issue arises from missing authorization checks on the 'service_process' function, which allows unauthenticated attackers to retrieve the Telegram Bot Token. This token is a sensitive secret that controls the Telegram bot, and its exposure constitutes an information disclosure vulnerability classified under CWE-200. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity due to network attack vector, no required privileges or user interaction, and high confidentiality impact.

An attacker can obtain the Telegram Bot Token without authentication, potentially allowing unauthorized control or manipulation of the Telegram bot associated with the WordPress site. This could lead to further malicious activities leveraging the bot. The confidentiality impact is high, while integrity and availability impacts are lower but present. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's endpoints and monitor for unusual activity involving the Telegram Bot Token. Consider disabling the plugin if possible to prevent exploitation.