CVE-2024-9685

Summary

CVE-2024-9685 is a vulnerability affecting the Notification for Telegram plugin for WordPress. This issue arises due to a missing capability check on the 'nftb_test_action' function inplugin versions up to and including 3.3.1. As a result, authenticated attackers with subscriber-level access or higher can exploit this vulnerability, enabling them to send test messages via the Telegram Bot API to all users configured in the plugin settings. This poses a significant security risk, allowing potentially harmful messages to be disseminated to unsuspecting users. It is recommended that users immediately upgrade to the latest version of the plugin to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.