The vulnerability is a deserialization flaw that allows an attacker to craft malicious data leading to PHP Object Injection in the Icegram Email Subscribers & Newsletters plugin. This manipulation of untrusted data can result in arbitrary code execution on the WordPress site, compromising confidentiality, integrity, and availability of the entire hosting environment. The weakness is identified as CWE‑502, which enables attackers to inject objects and control program flow.

WordPress sites that have the Icegram Email Subscribers & Newsletters plugin installed with any version up to and including 5.9.10. The affected component is the plugin’s data handling routines that deserialize user-provided input without proper validation.

The CVSS base score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, but given the potential for remote code execution, the risk remains significant. Based on the description, it is inferred that the likely attack vector involves delivering crafted data through the plugin’s input processing interface—potentially via front‑end or administrative forms—to trigger the deserialization flaw.