The vulnerability is a missing authorization check (CWE‑862) that allows any authenticated user with role or higher to alter core email configuration and content. An attacker can overwrite the plugin’s from‑name and from‑email address, inject arbitrary contacts, craft newsletter broadcasts, set up post notifications, add workflows, and trigger mass‑mail dispatches to any target addresses. The impact is that the site’s email system can be hijacked to send spam or phishing emails that appear to originate from the legitimate domain, potentially damaging reputation and exposing the system to further exploitation.

All releases of the Email Subscribers & Newsletters plugin authored by icegram up to and including version 5.9.27 are affected; newer versions are not listed as vulnerable.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated WordPress account with contributor-level privileges and is achieved by invoking the Ajax action named "ig_es_handle_request". Once the authorization bypass is triggered, the attacker can modify settings and send arbitrary emails without additional authorization.