Medium severity4.3NVD Advisory· Published Oct 10, 2024· Updated Jun 17, 2026

CVE-2024-9685

Description

The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_action' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a test message via the Telegram Bot API to all users configured in the settings.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Notification For Telegramllm-fuzzy
Range: <=3.3.1
Package: https://wordpress.org/plugins/notification-for-telegram
rainafarai/Notification for Telegramv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3165615/notification-for-telegramnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/abaebd3b-69ab-4e9b-a528-c9d846e62238nvdThird Party Advisory
plugins.trac.wordpress.org/browser/notification-for-telegram/tags/3.3/index.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000