The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::check?onnection' function in versions up to, and including, 4.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.
References
Configurations
History
26 Feb 2025, 08:12
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
23 Jan 2025, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f7e545-5e14-421e-90b4-bc54b23d0fe6?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/admin/class-wps-telegram-chat-admin.php#L176 - Broken Link | |
| CPE | cpe:2.3:a:10web:wps_telegram_chat:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
10web
10web wps Telegram Chat |
25 Oct 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-25 08:15
Updated : 2025-02-26 08:12
NVD link : CVE-2024-9628
Mitre link : CVE-2024-9628
JSON object : View
Products Affected
10web
- wps_telegram_chat
CWE
No CWE.