CVE-2024-9821: 
WordPress vulnerability analysis and mitigation

The Bot for Telegram on WooCommerce plugin for WordPress (CVE-2024-9821) contains a sensitive information disclosure vulnerability affecting versions up to and including 1.2.4. The vulnerability stems from missing authorization checks on the 'stmwpcftoget_settings' AJAX action. The vulnerability was discovered and disclosed on October 11, 2024 (NVD).

The vulnerability exists due to insufficient authorization checks in the plugin's AJAX functionality. Specifically, the 'stmwpcftoget_settings' AJAX action lacks proper access controls. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness has been classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to view the Telegram Bot Token, which is a secret token used to control the bot. Using this token, attackers can potentially log in as any existing user on the site, including administrators, if they know the username, by exploiting the Login with Telegram feature (NVD).