CVE-2025-12348

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12348", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-27T14:21:51.223Z", "datePublished": "2025-12-12T09:20:29.470Z", "dateUpdated": "2026-04-08T17:21:15.908Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:15.908Z"}, "affected": [{"vendor": "icegram", "product": "Email Subscribers & Newsletters \u2013 Email Marketing, Post Notifications & Newsletter Plugin for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.9.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage."}], "title": "Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ba7244-0ecf-412f-9b8b-6b81fa6cdeb5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-ig-es-background-process-helper.php#L194"}, {"url": "https://plugins.trac.wordpress.org/changeset/3394838/email-subscribers/trunk/lite/includes/classes/class-ig-es-background-process-helper.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Adrian Lukita"}], "timeline": [{"time": "2025-12-11T21:13:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T20:49:00.876134Z", "id": "CVE-2025-12348", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:49:12.755Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12348", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:49:00.876134Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:49:08.228Z"}}], "cna": {"title": "Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution", "credits": [{"lang": "en", "type": "finder", "value": "Adrian Lukita"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "icegram", "product": "Email Subscribers & Newsletters \u2013 Email Marketing, Post Notifications & Newsletter Plugin for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.9.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T21:13:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ba7244-0ecf-412f-9b8b-6b81fa6cdeb5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-ig-es-background-process-helper.php#L194"}, {"url": "https://plugins.trac.wordpress.org/changeset/3394838/email-subscribers/trunk/lite/includes/classes/class-ig-es-background-process-helper.php"}], "descriptions": [{"lang": "en", "value": "The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:15.908Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12348", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:15.908Z", "dateReserved": "2025-10-27T14:21:51.223Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T09:20:29.470Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Email Subscribers & Newsletters \u2013 Email Marketing, Post Notifications & Newsletter Plugin for WordPress", "vendor": "icegram", "versions": [{"lessThanOrEqual": "5.9.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage."}, {"lang": "es", "value": "El plugin Icegram Express - Email Subscribers, Newsletters and Marketing Automation para WordPress es vulnerable a la Falta de Autorizaci\u00f3n en versiones hasta la 5.9.10 (inclusive). Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n en la funci\u00f3n 'run_action_scheduler_task'. Esto hace posible que atacantes no autenticados ejecuten acciones programadas de forma anticipada o repetida adivinando los ID de las acciones, lo que podr\u00eda desencadenar env\u00edos de correos electr\u00f3nicos, tareas de mantenimiento u otras operaciones privilegiadas, provocando cambios de estado inesperados y un uso inesperado de recursos."}], "id": "CVE-2025-12348", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12348", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T20:49:00.876134Z", "version": "2.0.3"}}]}, "published": "2025-12-12T10:15:48.343", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L50"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-ig-es-background-process-helper.php#L194"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3394838/email-subscribers/trunk/lite/includes/classes/class-ig-es-background-process-helper.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ba7244-0ecf-412f-9b8b-6b81fa6cdeb5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:50:21.290943+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to version 5.9.11 or later, which removes the missing authentication check.", "If an immediate update is not possible, restrict external access to the action scheduler endpoint by removing or tightening role permissions and disabling unnecessary background processes.", "Monitor the site for unexpected email activity, resource spikes, or other indicators that scheduled tasks are being invoked unauthorizedly."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Action Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Icegram Express Email Subscribers and Newsletters plugin, version 5.9.10 or earlier.", "description_and_impact": "The Icegram Express Email Subscribers and Newsletters plugin for WordPress allows unauthenticated users to trigger the run_action_scheduler_task function without proper authorization. This missing authorization permits attackers to force the execution of scheduled tasks early or repeatedly by guessing action IDs, potentially sending unwanted emails, running maintenance scripts, or performing other privileged operations that alter system state or consume resources. The weakness is an example of CWE\u2011306, Missing Authentication.", "risk_and_exploitability": "The CVSS score of 5.3 designates a medium severity level, and an EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit this weakness remotely over the web with no authentication, but success requires identifying valid action identifiers. While the impact is limited to the plugin\u2019s scheduled tasks, repeated exploitation could lead to spam email delivery, excessive load, or corruption of the application state."}}}}, "created": "2025-12-14T21:16:31.217670+00:00", "updated": "2026-04-21T01:00:12.951297+00:00", "vendors": ["icegram", "icegram$PRODUCT$email_subscribers_&_newsletters", "wordpress", "wordpress$PRODUCT$wordpress"]}