This vulnerability is a CSRF issue in the Notification for Telegram plugin by rainafarai, affecting versions up to 3.5. It allows attackers to perform unauthorized actions by exploiting the trust a web application places in the user's browser. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and results in limited integrity impact without affecting confidentiality or availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

The impact is limited to potential unauthorized actions performed via CSRF, which could alter data or settings within the Notification for Telegram plugin. There is no impact on confidentiality or availability. The medium severity reflects the limited scope and requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as verifying CSRF tokens in requests or restricting actions to trusted users. Monitor official vendor channels for updates.