guruteam vulnerabilities

Products

• Bot for Telegram on WooCommerce 2

Latest guruteam CVEs

Newest publication first

1. CVE-2026-109516 Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.58%

   The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and...

2. CVE-2024-9821 Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass

   Published 2024-10-12

   High·CVSS 8.8 EPSS 1.2%

   The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attack...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.