Is CVE-2026-11592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11592 being exploited in the wild.

How severe is CVE-2026-11592?

Medium severity, with a CVSS score of 4.3, published 2 July 2026.

Which products and versions are affected?

Icegram Email Subscribers & Newsletters up to, and including, 5.9.27.

Is there a fix for CVE-2026-11592?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11592 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11592?

Check whether you run Icegram Email Subscribers & Newsletters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11592: Icegram Email Subscribers & Newsletters authorization bypass

CVE-2026-11592 · Severity: medium · CVSS 4.3 · Published 2026-07-02

The Email Subscribers & Newsletters plugin for WordPress, which manages marketing campaigns and automated notifications, contains a security flaw that allows lower-level users to perform administrative tasks. An attacker with a basic account (such as a contributor) could change the sender's email address, modify subscriber lists, and send unauthorized mass emails to your customers. This could lead to reputation damage through spam or phishing campaigns sent directly from your official domain.

Technologies: Icegram Email Subscribers & Newsletters. Vendors: Icegram.

Quick answers

Is CVE-2026-11592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11592 being exploited in the wild.
How severe is CVE-2026-11592?: Medium severity, with a CVSS score of 4.3, published 2 July 2026.
Which products and versions are affected?: Icegram Email Subscribers & Newsletters up to, and including, 5.9.27.
Is there a fix for CVE-2026-11592?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11592 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11592?: Check whether you run Icegram Email Subscribers & Newsletters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Email Subscribers & Newsletters plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in versions up to and including 5.9.27. The vulnerability exists because the plugin fails to properly verify user permissions before executing various administrative actions. An authenticated attacker with contributor-level privileges or higher can exploit this to overwrite mail settings (such as 'from' name and email), manage audience lists, create or modify newsletter broadcasts, and dispatch mass emails to arbitrary recipients. The issue is present across multiple components including the admin onboarding and workflow modules. Users should update to a version beyond 5.9.27 to mitigate these risks.

Affected products

Icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress up to, and including, 5.9.27

Timeline

2026-07-02: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.