CVE-2025-12349: Icegram Express Auth Bypass Vulnerability

CVE-2025-12349 Overview

CVE-2025-12349 affects the Icegram Express - Email Subscribers, Newsletters and Marketing Automation plugin for WordPress in versions up to and including 5.9.10. The plugin fails to verify authorization inside the trigger_mailing_queue_sending function. Unauthenticated attackers can invoke the function remotely over the network. Exploitation forces immediate email queue processing, bypasses the plugin's scheduler, and mutates internal state such as last-cron-hit. The flaw is classified under CWE-306: Missing Authentication for a Critical Function and enables denial-of-service-like server load spikes and marketing automation abuse.

Critical Impact
Unauthenticated attackers can trigger mail queue execution on demand, driving CPU and outbound mail volume high enough to degrade WordPress site availability.

Affected Products

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress
All versions up to and including 5.9.10
WordPress sites running the vulnerable email-subscribers plugin

Discovery Timeline

2025-11-19 - CVE-2025-12349 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12349

Vulnerability Analysis

The vulnerability resides in the plugin's mail queue trigger logic within class-es-queue.php. The trigger_mailing_queue_sending function processes requests that should be reserved for authenticated administrators or the WordPress cron subsystem. The plugin registers a request handler that calls this function without a capability check or nonce validation. As a result, any remote client can initiate the mail-sending routine at will. Repeated invocations can be scripted to hammer the endpoint, consume outbound mail resources, and manipulate plugin state values that track cron activity. Attackers do not need credentials, user interaction, or prior access to the target site.

Root Cause

The root cause is a Missing Authorization defect [CWE-306]. The trigger_mailing_queue_sending function does not call current_user_can(), verify a WordPress nonce, or check that the request originates from the internal cron pipeline. The referenced source at lines 54 and 1132 of lite/includes/classes/class-es-queue.php in tag 5.9.4 demonstrates the exposed entry point. Any code path reachable from an unauthenticated HTTP request should enforce an explicit authorization gate before mutating plugin state or dispatching mail.

Attack Vector

An attacker sends unauthenticated HTTP requests to the WordPress site invoking the trigger endpoint. Each request forces the plugin to flush its mail queue immediately and updates the last-cron-hit marker. Automated requests amplify server CPU usage, database writes, and outbound SMTP traffic. The plugin's scheduling logic is bypassed entirely, breaking marketing cadence and enabling denial-of-service style disruption. Verified technical details are available in the Wordfence Vulnerability Report and the WordPress Changeset Overview.

Detection Methods for CVE-2025-12349

Indicators of Compromise

Repeated unauthenticated HTTP requests to WordPress endpoints that resolve to the Icegram Express mail queue trigger
Abnormally frequent updates to the last-cron-hit option in the wp_options table
Sudden bursts of outbound SMTP traffic outside configured send schedules
Elevated PHP-FPM or MySQL load correlated with requests from a small set of source IPs

Detection Strategies

Alert on HTTP request rates to the Icegram Express action handler exceeding a per-source baseline
Compare scheduled wp_cron intervals against the actual timestamps recorded in last-cron-hit
Correlate WordPress access logs with mail transport logs to surface off-schedule bulk send events

Monitoring Recommendations

Enable WordPress plugin audit logging to record option changes and mail dispatch events
Forward web server, PHP, and mail transport logs to a centralized analytics platform for correlation
Track the installed version of the email-subscribers plugin across all managed WordPress sites and flag versions at or below 5.9.10

How to Mitigate CVE-2025-12349

Immediate Actions Required

Update the Icegram Express plugin to a version above 5.9.10 that includes the fix from changeset 3394838
Audit wp_options for anomalous last-cron-hit values and reset scheduled cron entries after patching
Restrict access to the WordPress site with a web application firewall rule that blocks unauthenticated requests to the plugin's trigger endpoint until patching is complete

Patch Information

The vendor addressed the issue in the plugin trunk via WordPress Changeset 3394838, which supersedes the vulnerable code in tag 5.9.4 referenced by the WordPress Class File Reference. Administrators should install the latest release from the WordPress plugin repository and confirm the plugin version reports higher than 5.9.10.

Workarounds

Deactivate the Icegram Express plugin until an updated version can be installed
Deploy WAF rules that require authenticated sessions or valid WordPress nonces for requests targeting the mail queue trigger handler
Rate-limit unauthenticated POST and GET requests to admin-ajax.php and plugin-specific endpoints at the reverse proxy layer

bash

# Example nginx rate-limit for WordPress admin-ajax endpoint
limit_req_zone $binary_remote_addr zone=wpajax:10m rate=5r/m;

location = /wp-admin/admin-ajax.php {
    limit_req zone=wpajax burst=10 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}