CVE-2026-7620

MediumCVSS 4.3

Published: 11/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The Notification for Telegram plugin for WordPress up to version 3.5.1 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.

Risk Assessment

The organization is at risk of unauthorized changes to the plugin's task schedule, which could disrupt its functionality, delay notifications, or potentially be used for DoS attacks by overloading the schedule.

Recommendation

Immediately update the Notification for Telegram plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin until a patch is released.

Other vulnerabilities in Notification for Telegram

CVE-2026-40732High
Versions of Notification for Telegram <= 3.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Original NVD description (English source)

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.