CVE-2025-62993
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Notification for Telegram plugin up to version 3.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to administrative functions or data, potentially leading to security breaches.
Recommendation
Update the plugin to the latest version and review access control configurations.
Other vulnerabilities in Notification for Telegram
See all- CVE-2026-93514High
The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-7620Medium
The Notification for Telegram plugin for WordPress up to version 3.5.1 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
- CVE-2026-40732High
Versions of Notification for Telegram <= 3.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through <= 3.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS