CVE-2024-9630

The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92	Broken Link
https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:10web:wps_telegram_chat:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-10-25 08:15

Updated : 2025-01-24 14:07

NVD link : CVE-2024-9630

Mitre link : CVE-2024-9630

CVE.ORG link : CVE-2024-9630

JSON object : View

Products Affected

10web

wps_telegram_chat

CWE

CWE-862

Missing Authorization

{"id": "CVE-2024-9630", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-10-25T08:15:03.657", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API."}, {"lang": "es", "value": "El complemento WPS Telegram Chat para WordPress es vulnerable a la omisi\u00f3n de autorizaci\u00f3n debido a una verificaci\u00f3n de capacidad faltante al acceder a mensajes en versiones hasta la 4.5.4 incluida. Esto hace posible que atacantes no autenticados vean los mensajes que se env\u00edan a trav\u00e9s de la API de bots de Telegram."}], "lastModified": "2025-01-24T14:07:11.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:10web:wps_telegram_chat:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "6BAC192A-D279-4D3F-B4DD-156EC53C329D", "versionEndIncluding": "4.5.4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}