PT-2024-39762 · WordPress · Order Notification For Telegram

István Márton · Published 2024-10-25 · Updated 2024-11-06 · CVE-2024-9686

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Order Notification for Telegram plugin for WordPress versions up to, and including, 1.0.1

Description The issue allows unauthorized test message sending due to a missing capability check on the nktgnfw send test message function. This makes it possible for unauthenticated attackers to send a test message via the Telegram Bot API to the user configured in the settings.

Recommendations For versions up to, and including, 1.0.1, as a temporary workaround, consider disabling the nktgnfw send test message function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-9686

Affected Products

Order Notification For Telegram

References · 6

• https://osv.dev/vulnerability/CVE-2024-9686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9686 · Security Note
• https://t.me/cvenotify/99460 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c182b4f2-c67b-4e82-a790-6d98946ebf2c?source=cve · Note
• https://t.me/cvedetector/8887 · Telegram Post
• https://plugins.trac.wordpress.org/browser/order-notification-for-telegram/tags/1.0.1/inc/admin_ajax.php#L5 · Note