CVE-2025-12348

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage.

• CWE-306

• https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L50
• https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-ig-es-background-process-helper.php#L194
• https://plugins.trac.wordpress.org/changeset/3394838/email-subscribers/trunk/lite/includes/classes/class-ig-es-background-process-helper.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ba7244-0ecf-412f-9b8b-6b81fa6cdeb5?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12342A flaw has been found in Serdar Bayram Ghost Hot Spot up to …7.3
• CVE-2025-12343A flaw was found in FFmpeg’s TensorFlow backend within the l…5.5
• CVE-2025-12344A vulnerability has been found in Yonyou U8 Cloud up to 5.1s…6.3
• CVE-2025-12345A security vulnerability has been detected in LLM-Claw 0.1.0…8.8
• CVE-2025-12346A vulnerability was detected in MaxSite CMS up to 109. This …8.8
• CVE-2025-12347A flaw has been found in MaxSite CMS up to 109. This issue a…8.8
• CVE-2025-12349The Icegram Express - Email Subscribers, Newsletters and Mar…5.3
• CVE-2025-1235A low privileged attacker can set the date of the devices to…4.3
• CVE-2025-12350The DominoKit plugin for WordPress is vulnerable to unauthor…5.3
• CVE-2025-12351Honeywell S35 Series Cameras contains an authorization bypas…6.8
• CVE-2025-12352The Gravity Forms plugin for WordPress is vulnerable to arbi…9.8
• CVE-2025-12353The WPFunnels – The Easiest Funnel Builder For WordPress And…5.3