CVE-2024-9685 identifies a missing authorization vulnerability in the Notification for Telegram WordPress plugin by rainafarai. Specifically, the 'nftb_test_action' function lacks a capability check, enabling authenticated users with subscriber-level privileges or above to send unauthorized test messages through the Telegram Bot API to all users configured in the plugin settings. This issue affects versions up to and including 3.3.1. The vulnerability has a CVSS v3.1 base score of 4.3 (medium severity), with an attack vector of network, low attack complexity, and requiring low privileges but no user interaction. No official patch or remediation guidance is currently provided.

An attacker with subscriber-level access or higher on a vulnerable WordPress site can send unauthorized test messages via the Telegram Bot API to all recipients configured in the plugin. This could lead to misuse of the messaging functionality, potential spam, or reputational damage. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and consider disabling or removing the Notification for Telegram plugin if unauthorized message sending poses a risk.