CVE-2025-58794

WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability

View on CVE.org
Published Sep 5, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.

Analysis

AI-generated

Technical impact

This CVE identifies a Cross‑Site Request Forgery flaw in the rainafarai Notification for Telegram WordPress plugin. The vulnerability allows a malicious site to send forged requests on behalf of an authenticated user, potentially enabling the attacker to perform unauthorized actions within the plugin without the user’s consent.

Affected Systems

The flaw affects all releases of rainafarai’s Notification for Telegram plugin up to and including version 3.5 on any WordPress installation. Site owners using these versions are impacted unless the plugin has been removed or disabled.

Risk and Exploitability

The CVSS base score of 4.3 indicates moderate severity, and the EPSS score of less than 1% points to a low likelihood of exploitation in the field. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw by tricking a logged‑in user into visiting a malicious page that submits CSRF requests to the vulnerable plugin endpoints.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Notification for Telegram plugin to the latest version (3.6 or newer).
  • If an upgrade is not immediately possible, delete or deactivate the plugin to eliminate the vulnerability.
  • Add or enforce CSRF protection, such as WordPress nonces, on any state‑changing plugin actions to prevent forged requests.

Generated by OpenCVE AI on April 30, 2026 at 02:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-26983 Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram allows Cross Site Request Forgery. This issue affects Notification for Telegram: from n/a through 3.4.6.
History
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.1. Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.
Title WordPress Notification for Telegram plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5. Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.1.
Title WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability WordPress Notification for Telegram plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram allows Cross Site Request Forgery. This issue affects Notification for Telegram: from n/a through 3.4.6. Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.
Title WordPress Notification for Telegram Plugin <= 3.4.6 - Cross Site Request Forgery (CSRF) Vulnerability WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram allows Cross Site Request Forgery. This issue affects Notification for Telegram: from n/a through 3.4.6.
Title WordPress Notification for Telegram Plugin <= 3.4.6 - Cross Site Request Forgery (CSRF) Vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 12, 2026, 12:46 AM
Reserved
Sep 5, 2025, 10:49 AM

View source JSON

Updated
Sep 5, 2025, 3:37 PM

JSON

Status
Deferred
Published
Sep 5, 2025, 2:15 PM
Modified
Jun 17, 2026, 9:44 AM

View source JSON

No data.

Updated
Apr 30, 2026, 2:45 AM

JSON