Threats tagged 'ghsa-cw4f-j2mf-3wm9'

The Bot for Telegram on WooCommerce plugin for WordPress versions up to and including 1.3.0 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge bot updates and impersonate any WordPress user by exploiting a REST endpoint that lacks proper permission checks and signature verification. Attackers can obtain a login token and gain persistent authenticated sessions without credentials, potentially taking over administrator accounts.