CVE-2026-7620
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Notification for Telegram plugin for WordPress up to version 3.5.1 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
Risk Assessment
The organization is at risk of unauthorized changes to the plugin's task schedule, which could disrupt its functionality, delay notifications, or potentially be used for DoS attacks by overloading the schedule.
Recommendation
Immediately update the Notification for Telegram plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin until a patch is released.
Other vulnerabilities in Notification for Telegram
See all- CVE-2026-93514High
The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-40732High
Versions of Notification for Telegram <= 3.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2025-62993Medium
The Notification for Telegram plugin up to version 3.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS