What the vulnerability does
01Description
The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
Explanation of Vulnerability in Simple Terms
02Summary
The Notification for Telegram plugin contains a missing authorization check that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a low-privilege account can send unauthorized requests to alter settings or content. The vulnerability affects versions up to 3.5.1. Update to a version newer than 3.5.1 to remediate.
What an attacker can do
03Attacker Capabilities
Modify data or settings without proper authorization checks.
Potential impact on your site
04Site Impact
Low-privilege users can alter plugin settings or data they should not be able to change.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
06Disclosure timeline
July 11, 2026
CVE published
July 13, 2026
Record updated
