Authorization Flaw in Icegram Express Email Subscribers Plugin for WordPress
CVE-2025-12349
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 November 2025
What is CVE-2025-12349?
The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress contains an authorization flaw in versions up to and including 5.9.10. This vulnerability arises from the plugin failing to adequately verify user permissions in the trigger_mailing_queue_sending function. Consequently, this allows unauthenticated attackers to bypass scheduled email deliveries, exert excessive load on servers, and manipulate the plugin's state, potentially causing denial-of-service (DoS) conditions and enabling further abusive behavior.
Affected Version(s)
Email Subscribers & Newsletters – Powerful Email Marketing, Post Notification & Newsletter Plugin for WordPress & WooCommerce * <= 5.9.10