CVE-2026-109516 | guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress REST Endpoint main bftow_get_user_system_id tgId improper authentication (EUVD-2026-112584)

October 29, 2026 Yanac

A vulnerability was found in guruteam Bot for Telegram Plugin up to 1.3.0 on WordPress. It has been rated as critical. The impacted element is the function bftow_get_user_system_id of the file /wp-json/woo-telegram/v1/main of the component REST Endpoint. This manipulation of the argument tgId causes improper authentication.

This vulnerability is handled as CVE-2026-109516. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More