PT-2025-47426 · WordPress · Icegram Express

Adrian Lukita · Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-12349

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Icegram Express versions prior to 5.9.11

Description The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress does not properly verify user authorization when performing actions within the trigger mailing queue sending function. This allows unauthenticated attackers to force immediate email sending, bypassing the schedule, potentially increasing server load, and altering plugin state, such as the last-cron-hit value, which could lead to abuse or denial-of-service-like effects.

Recommendations Update Icegram Express to version 5.9.11 or later.

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-12349

Affected Products

Icegram Express

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12349 · Security Note
• https://twitter.com/CVEnew/status/1991042921609466010 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991097206095421897 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394838%40email-subscribers%2Ftrunk&old=3393565%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/143300 · Telegram Post
• https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L54 · Note
• https://t.me/CVEtracker/37708 · Telegram Post
• https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L1132 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0b4cbe21-9f1b-425b-8141-ae075baaf717?source=cve · Note