CVE-2025-62993: 
WordPress vulnerability analysis and mitigation

CVE-2025-62993 is a Missing Authorization (Broken Access Control) vulnerability in the "Notification for Telegram" WordPress plugin developed by rainafarai. It allows authenticated attackers with low privileges (Subscriber level) to exploit incorrectly configured access control security levels. The vulnerability affects all plugin versions up to and including 3.5.1, with version 3.5.2 being the patched release. It was reported on October 30, 2025, and published on November 29, 2025, by Patchstack. The CVSS v3.1 base score is 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. The attack vector is network-based, requires low privileges (e.g., a Subscriber-level WordPress account), and no user interaction. An attacker can send crafted requests to plugin endpoints that lack proper authorization checks, allowing them to perform actions intended for higher-privileged roles (Patchstack).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged user can perform unauthorized actions within the plugin's functionality, such as modifying Telegram notification settings. There is no confidentiality or availability impact based on the CVSS assessment. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exposure (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites, this specific issue is rated low priority and considered unlikely to be exploited (Patchstack).

The vendor has released version 3.5.2 of the Notification for Telegram WordPress plugin, which resolves this vulnerability. Site administrators should update the plugin to version 3.5.2 or later immediately. If an immediate update is not possible, restricting user registration or limiting Subscriber-level access on the WordPress site can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).