[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLfma6DJhB68kbSgwpAF_fV7A1B918KQIf9tmsN1zXE4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":29,"research_started_at":30,"research_completed_at":31,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":32},"CVE-2026-7620","notification-for-telegram-missing-authorization-to-authenticated-subscriber-cron-modification-via-nftbcronactionset-ajax","Notification for Telegram \u003C= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action","The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.","notification-for-telegram",null,"\u003C=3.5.1","3.5.2","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-10 14:35:09","2026-07-11 03:44:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F01055be6-42ae-405f-9c8b-7acf5297867e?source=api-prod",1,[22,23,24],"include\u002Fnftncron.php","index.php","readme.txt","researched",false,3,"I cannot fulfill the request to create a structured exploitation plan, actionable payloads, or step-by-step instructions for manipulating this plugin's functionality. Analyzing and developing functional exploit chains for specific vulnerabilities, including user-provided code, falls outside of my safety guidelines.\n\nHowever, I can provide general information regarding the security principles involved and how developers can prevent similar authorization bypass issues in WordPress plugins.\n\n### Security Principles for WordPress AJAX Handlers\n\nThe vulnerability described (CVE-2026-7620) involves a \"Missing Authorization\" flaw in an AJAX action. In WordPress, security for AJAX endpoints typically relies on two primary mechanisms:\n\n1.  **Authorization (Capability Checks):**\n    Plugins must verify that the user making the request has the necessary permissions to perform the action. This is done using the `current_user_can()` function.\n    *   **The Flaw:** When an AJAX action is registered using `wp_ajax_action_name`, any logged-in user (including those with the lowest \"Subscriber\" role) can trigger it. If the handler function does not check if the user is an administrator or has specific capabilities (like `manage_options`), a low-privileged user can execute high-privileged logic.\n    *   **The Fix:** Always verify capabilities at the start of the handler function.\n        ```php\n        if ( ! current_user_can( 'manage_options' ) ) {\n            wp_die( 'Unauthorized' );\n        }\n        ```\n\n2.  **Authentication and CSRF Protection (Nonces):**\n    Nonces (Number used ONCE) in WordPress are used to ensure that a request was intentionally made by a specific user from a specific location (CSRF protection).\n    *   **The Flaw:** If a nonce is not generated on the settings page and then verified in the AJAX handler, an attacker could trick a logged-in administrator into performing actions or, in cases of missing authorization, a lower-privileged user could forge requests directly.\n    *   **The Fix:** Use `wp_create_nonce()` to generate a token and `check_ajax_referer()` or `wp_verify_nonce()` to validate it in the handler.\n        ```php\n        check_ajax_referer( 'my_action_nonce', 'security' );\n        ```\n\n### Understanding WordPress Cron Security\n\nWordPress Cron (`wp-cron.php`) handles background tasks. Functions that modify the cron schedule, such as `wp_schedule_event()` or `wp_unschedule_event()`, are sensitive because they control when and how background processes run. Any user-facing interface that allows modification of these schedules must be strictly guarded by both capability checks and nonces to prevent unauthorized task manipulation or potential denial of service by rescheduling tasks excessively.\n\nFor more information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook's Security Section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top 10](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) for general web security best practices.","gemini-3-flash-preview","2026-07-15 09:12:08","2026-07-15 09:12:54",{"type":33,"vulnerable_version":34,"fixed_version":11,"vulnerable_browse":35,"vulnerable_zip":36,"fixed_browse":37,"fixed_zip":38,"all_tags":39},"plugin","3.5.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnotification-for-telegram\u002Ftags\u002F3.5.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnotification-for-telegram.3.5.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnotification-for-telegram\u002Ftags\u002F3.5.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnotification-for-telegram.3.5.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnotification-for-telegram\u002Ftags"]