The Icegram Email Subscribers & Newsletters plugin for WordPress contains an authorization flaw that permits unauthenticated attackers to invoke the trigger_mailing_queue_sending function. This flaw lets an attacker force the plugin to send emails immediately, bypass scheduled sending, alter plugin state such as the last-cron-hit property, and potentially overload the server with outbound mail, creating spam or DoS‑like effects.

Icegram Email Subscribers & Newsletters WordPress plugin for versions 5.9.10 and earlier is affected. Users of any installation running these or earlier versions are within scope.

With a CVSS score of 5.3, the severity is moderate. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of assessment, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote via an unauthenticated HTTP request to the plugin’s queue trigger endpoint, which can be performed by any internet-connected user with access to the site’s public URLs.