CVE-2024-9628: WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API

Published Oct 25, 2024
·
Updated

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.

Affected Software

2 affected components
wps Telegram Chat<=4.5.4
10web Wps Telegram Chat Wordpress<=4.5.4

Event History

Oct 25, 2024
CVE Published
via MITRE·07:38 AM
Data Sourced
via MITRE·07:38 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-9628?

CVE-2024-9628 has a high severity due to its potential for unauthorized data modification and loss.

2

How do I fix CVE-2024-9628?

To fix CVE-2024-9628, update the WPS Telegram Chat plugin to version 4.5.5 or later.

3

What versions are affected by CVE-2024-9628?

CVE-2024-9628 affects all versions of the WPS Telegram Chat plugin up to and including 4.5.4.

4

Can I still use the WPS Telegram Chat plugin with CVE-2024-9628 vulnerabilities?

It is not recommended to use the WPS Telegram Chat plugin with CVE-2024-9628 vulnerabilities without applying the necessary updates.

5

What impact does CVE-2024-9628 have on my WordPress site?

CVE-2024-9628 can lead to unauthorized changes and potential data loss on your WordPress site, compromising its integrity.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2024-9628 - WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API - SecAlerts