WordPress Bot for Telegram WooCommerce Plugin Authentication Bypass Account Takeover

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to an Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0.

The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification. An unauthenticated attacker can POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header.

• The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less ?action=bftow_create_order&bftow_token= endpoint.
• That endpoint calls wp_set_auth_cookie() unconditionally via login_user_by_id, issuing a persistent authenticated session cookie for the targeted account.
• This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username.