Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2024-9628

WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wpsolution WPS Telegram Chat

Default version status: unaffected

  • 0 to ≤ 4.6.0affected

References