CVE-2024-9686

Name of the Vulnerable Software and Affected Versions The Order Notification for Telegram plugin for WordPress versions up to, and including, 1.0.1

Description The issue allows unauthorized test message sending due to a missing capability check on the nktgnfw send test message function. This makes it possible for unauthenticated attackers to send a test message via the Telegram Bot API to the user configured in the settings.

Recommendations For versions up to, and including, 1.0.1, as a temporary workaround, consider disabling the nktgnfw send test message function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.