CVE-2024-9629 identifies a missing authorization vulnerability (CWE-862) in the hokku Contact Form 7 + Telegram plugin for WordPress, specifically in the 'wpcf7_Telegram::ajax' function. This function lacks proper capability checks, allowing authenticated users with subscriber-level access or higher to perform unauthorized actions on subscription data. These actions include approving, pausing, or refusing subscriptions, which can lead to unauthorized modification or loss of subscription data. The vulnerability affects all versions up to and including 0.8.5. The CVSS 3.1 base score is 5.4 (medium), reflecting that the attack vector is remote network (AV:N), with low attack complexity (AC:L), requiring privileges (PR:L) but no user interaction (UI:N). The impact affects integrity and availability but not confidentiality. No patches or exploits are currently publicly available, but the vulnerability is published and should be addressed promptly. The flaw arises from insufficient authorization checks in AJAX handlers, a common issue in WordPress plugins that can lead to privilege escalation or unauthorized data manipulation.

The vulnerability allows authenticated users with minimal privileges (subscriber-level) to manipulate subscription statuses without authorization, potentially disrupting subscription workflows and causing data integrity issues. This could result in denial of service for legitimate subscribers if their subscriptions are paused or refused maliciously. While confidentiality is not directly impacted, the integrity and availability of subscription data are at risk. For organizations relying on this plugin for customer engagement or communication via Telegram, this could degrade service quality and trust. Attackers exploiting this flaw could also use it as a foothold for further attacks within the WordPress environment. The scope is limited to sites using the vulnerable plugin, but given WordPress's extensive market share, the number of affected sites could be significant worldwide.

Organizations should immediately verify if they use the hokku Contact Form 7 + Telegram plugin and identify the version in use. Since no official patch links are provided yet, administrators should consider temporarily disabling the plugin or restricting access to authenticated users with subscriber-level privileges until a fix is released. Implementing custom capability checks or access controls on the AJAX endpoints can mitigate unauthorized actions. Monitoring logs for unusual subscription state changes can help detect exploitation attempts. Keeping WordPress core and all plugins updated regularly is critical. Once a patch is released, prompt application is essential. Additionally, applying the principle of least privilege by limiting subscriber-level user capabilities can reduce exploitation risk. Employing web application firewalls (WAFs) with rules targeting unauthorized AJAX requests may provide interim protection.