PT-2024-39730 · WordPress · Wps Telegram Chat

István Márton · Published 2024-10-25 · Updated 2025-01-24 · CVE-2024-9630

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPS Telegram Chat plugin for WordPress versions up to, and including, 4.5.4

Description The issue is related to authorization bypass due to a missing capability check when accessing messages. This allows unauthenticated attackers to view messages sent through the Telegram Bot API.

Recommendations For versions up to, and including, 4.5.4, update to a version that includes a fix for the missing capability check to prevent unauthorized access to messages. As a temporary workaround, consider restricting access to the Telegram Bot API until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-9630

Affected Products

Wps Telegram Chat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-9630 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9630 · Vendor Advisory
• https://t.me/cvenotify/108426 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve · Note
• https://t.me/cvedetector/8908 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92 · Note
• https://t.me/cvenotify/108472 · Telegram Post