The Icegram Express Email Subscribers and Newsletters plugin for WordPress allows unauthenticated users to trigger the run_action_scheduler_task function without proper authorization. This missing authorization permits attackers to force the execution of scheduled tasks early or repeatedly by guessing action IDs, potentially sending unwanted emails, running maintenance scripts, or performing other privileged operations that alter system state or consume resources. The weakness is an example of CWE‑306, Missing Authentication.

WordPress sites using the Icegram Express Email Subscribers and Newsletters plugin, version 5.9.10 or earlier.

The CVSS score of 5.3 designates a medium severity level, and an EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit this weakness remotely over the web with no authentication, but success requires identifying valid action identifiers. While the impact is limited to the plugin’s scheduled tasks, repeated exploitation could lead to spam email delivery, excessive load, or corruption of the application state.