Auth bypass in 10web Wps Telegram Chat
CVE-2024-9630
The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.
Vulnerability class: Broken Access Control
EPSS: 0.003 (18.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- 10web Wps_telegram_chat
- Wpsolution Wps Telegram Chat — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Broken Link)
Frequently asked questions
- What is CVE-2024-9630?
- CVE-2024-9630 is a medium-severity vulnerability in 10web Wps Telegram Chat, classified under Missing Authorization. CVSS score: 5.4/10. Published 2024-10-25.
- How severe is CVE-2024-9630?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2024-9630 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.