CVE-2024-9630

The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92	Broken Link
https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:10web:wps_telegram_chat:*:*:*:*:*:wordpress:*:*

History

24 Jan 2025, 14:07

Type	Values Removed	Values Added
First Time		10web wps Telegram Chat 10web
CPE	cpe:2.3:a:wpsolutions:wps_telegram_chat::::::wordpress::*	cpe:2.3:a:10web:wps_telegram_chat::::::wordpress::*

23 Jan 2025, 20:56

Type	Values Removed	Values Added
First Time		Wpsolutions Wpsolutions wps Telegram Chat
References	~~() https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92 -~~	() https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92 - Broken Link
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve - Third Party Advisory
CPE		cpe:2.3:a:wpsolutions:wps_telegram_chat::::::wordpress::*

Information

Published : 2024-10-25 08:15

Updated : 2025-01-24 14:07

NVD link : CVE-2024-9630

Mitre link : CVE-2024-9630

CVE.ORG link : CVE-2024-9630

JSON object : View

Products Affected

10web

wps_telegram_chat

CWE

CWE-862

Missing Authorization

{"id": "CVE-2024-9630", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-10-25T08:15:03.657", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92", "tags": ["Broken Link"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API."}, {"lang": "es", "value": "El complemento WPS Telegram Chat para WordPress es vulnerable a la omisi\u00f3n de autorizaci\u00f3n debido a una verificaci\u00f3n de capacidad faltante al acceder a mensajes en versiones hasta la 4.5.4 incluida. Esto hace posible que atacantes no autenticados vean los mensajes que se env\u00edan a trav\u00e9s de la API de bots de Telegram."}], "lastModified": "2025-01-24T14:07:11.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:10web:wps_telegram_chat:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "6BAC192A-D279-4D3F-B4DD-156EC53C329D", "versionEndIncluding": "4.5.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}