CVE-2026-7620

Name: CVE-2026-7620 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-7620

MEDIUM

CVSS v3.1: 4.3 · EPSS: 0.0025 (16.3 percentile)

NetworkNo user interactionMissing Authorization

Source data as of: 2026-07-12 05:00:25 UTC

At a glance

Severity: MEDIUM
CVSS: 4.3 v3.1 · NVD
EPSS: 0.0025 (16.3 percentile) · FIRST.org
CISA KEV: No
Type: Missing Authorization · NVD CWE
Attack conditions (CVSS vector): NetworkNo user interaction · Source: NVD Vector
Published: 2026-07-11 · Modified: 2026-07-11
References: Jump to references (8)

CVSS / EPSS / KEV

CVSS v3.1 4.3 / 10 MEDIUM Source: NVD

EPSS 0.0025 16.3 percentile Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.

Record details

CVE ID: CVE-2026-7620
CVSS (v3.1): 4.3 (MEDIUM)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability subscore: 2.8
Impact subscore: 1.4
EPSS: 0.0025 (16.3 percentile) — 2026-07-12
CISA KEV: No
Weakness (CWE): CWE-862
Affected configurations (CPE): 0
Published: 2026-07-11
Modified: 2026-07-11
Status: Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

← Back to all records

CVE-2026-7620

At a glance

CVSS / EPSS / KEV

Description

Record details

References

Related records

Same weakness type (CWE)

Published the same year