The vulnerability is a Server‑Side Request Forgery (CWE‑918) that allows an attacker to make the plugin initiate HTTP requests to arbitrary internal or external addresses. The affected plugin component can be used to retrieve data or execute arbitrary commands over the network. Because the plugin runs with the privileges of the web server, a successful exploitation could expose confidential internal resources or allow lateral movement within the hosting environment.

Icegram Express Pro, the email‑subscribers‑premium WordPress plugin, is vulnerable in all released versions up to and including 5.9.5. The vulnerability applies to every site that has this plugin installed, regardless of the website’s user base or configuration.

The CVSS score of 4.4 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s web interface; an attacker must first interact with a vulnerable instance, but no authentication is required. Once executed, the attacker can direct the server to connect to arbitrary hosts.