icegram Email Subscribers & Newsletters Plugin up to 5.9.27 on WordPress Setting authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in icegram Email Subscribers & Newsletters Plugin up to 5.9.27 on WordPress. Affected is an unknown function of the component Setting Handler. The manipulation leads to authorization. This vulnerability is listed as CVE-2026-11592. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in icegram Email Subscribers & Newsletters Plugin up to 5.9.27 on WordPress. It has been rated as critical. This issue affects an unknown functionality of the component Setting Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite plugin mail settings (from name and from email address), create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients.

The weakness was presented by Dmitrii Ignatyev. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-11592 since 06/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 5.9.21 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-41248). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• icegram

Name

• Email Subscribers & Newsletters Plugin

Version

• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3
• 5.9.4
• 5.9.5
• 5.9.6
• 5.9.7
• 5.9.8
• 5.9.9
• 5.9.10
• 5.9.11
• 5.9.12
• 5.9.13
• 5.9.14
• 5.9.15
• 5.9.16
• 5.9.17
• 5.9.18
• 5.9.19
• 5.9.20
• 5.9.21
• 5.9.22
• 5.9.23
• 5.9.24
• 5.9.25
• 5.9.26
• 5.9.27

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion