Junglewise Threat Intelligence

CVE-2026-11592: Icegram Email Subscribers & Newsletters authorization bypass

CVE-2026-11592 · Severity: medium · CVSS 4.3 · Published 2026-07-02

Technologies: Icegram Email Subscribers & Newsletters. Vendors: Icegram.

Executive brief

The Email Subscribers & Newsletters plugin for WordPress, which manages marketing campaigns and automated notifications, contains a security flaw that allows lower-level users to perform administrative tasks. An attacker with a basic account (such as a contributor) could change the sender's email address, modify subscriber lists, and send unauthorized mass emails to your customers. This could lead to reputation damage through spam or phishing campaigns sent directly from your official domain.

Technical details

The Email Subscribers & Newsletters plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in versions up to and including 5.9.27. The vulnerability exists because the plugin fails to properly verify user permissions before executing various administrative actions. An authenticated attacker with contributor-level privileges or higher can exploit this to overwrite mail settings (such as 'from' name and email), manage audience lists, create or modify newsletter broadcasts, and dispatch mass emails to arbitrary recipients. The issue is present across multiple components including the admin onboarding and workflow modules. Users should update to a version beyond 5.9.27 to mitigate these risks.

Affected products

  • Icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress up to, and including, 5.9.27

Timeline

  • 2026-07-02: disclosed: NVD publication date

References

Related threats