The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permission_callback => '__return_true' and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a message.chat.id set to any WordPress login name; bftow_get_user_system_id() resolves this attacker-supplied value to the targeted account via get_user_by('login', $tgId) with no ownership proof, and writes a login token computed as md5($_SERVER['HTTP_USER_AGENT'] . time()) — both inputs are fully attacker-controlled or bounded within seconds using the response's own Date header. The…