Authorization Flaw in Icegram Express Email Subscribers Plugin for WordPress

CVE-2025-12349

What is CVE-2025-12349?

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress contains an authorization flaw in versions up to and including 5.9.10. This vulnerability arises from the plugin failing to adequately verify user permissions in the trigger_mailing_queue_sending function. Consequently, this allows unauthenticated attackers to bypass scheduled email deliveries, exert excessive load on servers, and manipulate the plugin's state, potentially causing denial-of-service (DoS) conditions and enabling further abusive behavior.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References