PT-2024-39866 · WordPress · The Bot For Telegram On Woocommerce

István Márton · Published 2024-10-12 · Updated 2024-10-17 · CVE-2024-9821

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Bot for Telegram on WooCommerce plugin for WordPress versions up to, and including, 1.2.4

Description The issue is related to sensitive information disclosure due to missing authorization checks on the 'stm wpcfto get settings' AJAX action. This allows authenticated attackers with subscriber-level access and above to view the Telegram Bot Token, which can be used to log in as any existing user on the site, such as an administrator, if they know the username, due to the Login with Telegram feature.

Recommendations For versions up to, and including, 1.2.4, update to a version that includes the necessary authorization checks for the 'stm wpcfto get settings' AJAX action to prevent sensitive information disclosure. As a temporary workaround, consider restricting access to the 'stm wpcfto get settings' AJAX action to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-9821

Affected Products

The Bot For Telegram On Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-9821 · Security Note
• https://t.me/cvenotify/97921 · Telegram Post
• https://t.me/latest_high_impact_cve/1308 · Telegram Post
• https://twitter.com/cracbot/status/1846793323358626176 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a662c904-ba2e-494c-a603-b22eeeddf43d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/trunk/nuxy/helpers/helpers.php?rev=2575772#L54 · Note
• https://t.me/cvedetector/7756 · Telegram Post