CVE-2026-7620 is an authorization bypass vulnerability (CWE-862) in the Notification for Telegram plugin for WordPress, affecting all versions up to and including 3.5.1. The plugin fails to properly verify that a user is authorized to perform certain actions related to the nftb_cron_hook WordPress cron event. As a result, authenticated users with subscriber-level privileges or higher can create, modify, or reschedule this cron event, allowing unauthorized manipulation of the plugin's background task scheduling logic.

The vulnerability allows authenticated users with relatively low privileges (subscriber-level and above) to interfere with the plugin's background task scheduling. This could lead to unauthorized changes in the plugin's operation, potentially disrupting expected functionality or enabling further misuse of the plugin's features. There is no direct impact on confidentiality or availability reported, and no known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Until a patch is available, restrict user roles to trusted users only and monitor for suspicious activity related to WordPress cron events associated with the plugin.