The Contact Form 7 + Telegram plugin for WordPress (hokku Message Bridge) versions up to 0.8.5 contain a missing authorization (CWE-862) vulnerability in the 'wpcf7_Telegram::ajax' function. This flaw permits authenticated users with low privileges (subscriber-level and above) to perform unauthorized actions on subscription data, including approving, pausing, or refusing subscriptions. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. No known exploits in the wild or official patches have been reported.

An attacker with subscriber-level access or higher can exploit this vulnerability to modify subscription data without proper authorization. This could result in unauthorized changes to subscription statuses and potential loss of data integrity within the plugin's subscription management. There is no indication of confidentiality impact, but integrity and availability impacts are present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to subscription management within the plugin. Avoid granting unnecessary privileges to low-level authenticated users.