Deserialization of untrusted data in the Icegram Express Pro plugin allows an attacker to perform PHP object injection by providing a crafted serialized string. The vulnerability is a classic instance of CWE‑502, where the plugin fails to properly safeguard against malicious input during unserialization, enabling the attacker to instantiate arbitrary objects or invoke arbitrary methods that can lead to code execution or modification of sensitive data.

WordPress sites that have the Icegram Express Pro email‑subscribers plugin installed with a version earlier than 5.9.14 are affected. The issue does not apply to versions 5.9.14 and newer, which have applied the necessary safeguard against unserialization of untrusted data.

The CVSS score of 7.2 indicates a high risk of serious impact, while the EPSS score of less than 1% suggests that exploitation attempts are currently low in probability. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at this time. The likely attack vector would involve sending a malicious serialized payload to the plugin’s endpoint or to a location where the plugin processes user‑supplied data, such as form submissions or query parameters. Successful exploitation would grant the attacker remote code execution capabilities on the affected WordPress installation.