What is the CVSS score of CVE-2026-7620?

CVE-2026-7620 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Notification for Telegram CVE-2026-7620

EUVD-2026-43131 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-76px-9qj6-wjpg

WordPress Authentication Bypass Wordpress Plugin Notification For Telegram

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires only subscriber auth (PR:L); integrity-only impact limited to cron manipulation; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:00 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.

AnalysisAI

Authorization bypass in the Notification for Telegram WordPress plugin (all versions through 3.5.1) allows authenticated subscribers to manipulate WordPress cron scheduling logic. Authenticated attackers with subscriber-level access or above can create, modify, or reschedule the nftb_cron_hook cron event due to missing authorization checks in nftncron.php, disrupting the plugin's background task scheduling for Telegram notifications. No public exploit or active exploitation has been identified at time of analysis; CVSS rates this Medium (4.3) with integrity-only impact.

Technical ContextAI

The vulnerability resides in the plugin's cron management file nftncron.php (CPE: cpe:2.3:a:rainafarai:notification_for_telegram:*:*:*:*:*:*:*:*), specifically at lines L94, L122, and L126, which handle registration, execution, and rescheduling of the nftb_cron_hook WordPress WP-Cron event. CWE-862 (Missing Authorization) is the root cause: the plugin registers AJAX or similar action handlers that perform privileged cron operations without verifying the requesting user possesses capabilities beyond subscriber-level. WordPress's capability system relies on plugins explicitly calling current_user_can() or equivalent checks; the absence of these checks is the direct flaw. The affected cron hook governs when the plugin dispatches Telegram notifications in the background.

RemediationAI

Upstream fix available via WordPress plugin repository changeset 3524838 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3524838%40notification-for-telegram&new=3524838%40notification-for-telegram); the exact patched release version is not independently confirmed from available data - WordPress site administrators should update to the latest available version of the plugin through the WordPress dashboard, which will deploy the trunk-based fix. As a compensating control pending upgrade, administrators can deactivate the Notification for Telegram plugin entirely if Telegram alerting is non-critical, which eliminates the exposed cron endpoints with no trade-off beyond loss of notification functionality. Sites that do not require public subscriber registration should ensure open registration is disabled (Settings > General > Membership), which eliminates the attacker's ability to obtain the required low-privilege account without further compromise. No workaround short of deactivation is available that preserves full plugin functionality.