The Notification for Telegram WordPress plugin is affected by a missing authorization flaw in all versions up to and including 3.5.1. The flaw involves the nftb_cron_action_set AJAX endpoint, which accepts requests to create, modify, or reschedule the nftb_cron_hook cron event without verifying the user’s privilege level. Because the check is absent, an authenticated user with subscriber or higher role can use this endpoint to manipulate the plugin’s background task schedule. Based on the description, it is inferred that such manipulation could lead to unintended notifications or other unexpected behaviour. This weakness is classified as CWE‑862 (Missing Authorization).

All releases of the Notification for Telegram plugin from rainafarai, versions up to and including 3.5.1, are impacted. Production WordPress sites using these versions must verify their plugin version against the vendor’s release logs. No newer versions are listed as affected in the available data.

The CVSS score of 4.3 places the vulnerability in the low‑medium range, and the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated with at least subscriber privileges, limiting the attack surface to compromised or newly created accounts with privileged roles. Based on the description, it is inferred that the most likely exploitation path involves a malicious user exploiting the exposed AJAX action to schedule unwanted cron events that could result in spam notifications or other undesired background tasks.