CVE-2024-9685

Summary

CVE-2024-9685 identifies a vulnerability in the Notification for Telegram plugin for WordPress, specifically versions up to and including 3.3.1, which lacks a capability check in the 'nftb_test_action' function. This flaw allows authenticated attackers with subscriber-level access or higher to send unauthorized test messages to all users configured within the plugin's settings via the Telegram Bot API. Organizations using affected products risk unauthorized communication and potential phishing attempts due to this vulnerability, which has been rated with a medium severity score of 4.3. To remediate this issue, users should update the plugin to the latest version where the vulnerability has been patched. The attack complexity is considered low, and no user interaction is required for exploitation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.