CVE-2024-9630: WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure
The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9630?
CVE-2024-9630 has been classified as a high severity vulnerability due to its potential for unauthorized access to sensitive message data.
How can I fix CVE-2024-9630?
To fix CVE-2024-9630, upgrade the WPS Telegram Chat plugin to version 4.5.5 or later, which includes the necessary capability checks.
Who is affected by CVE-2024-9630?
CVE-2024-9630 affects users of the WPS Telegram Chat plugin for WordPress versions up to and including 4.5.4.
What are the consequences of CVE-2024-9630?
The consequences of CVE-2024-9630 include the potential for unauthenticated attackers to access and view private messages sent through the plugin.
Is CVE-2024-9630 a zero-day vulnerability?
CVE-2024-9630 is not a zero-day vulnerability as it has been publicly disclosed with a fix available.