A high-severity deserialization vulnerability in the Icegram Email Subscribers and Newsletters plugin allows authenticated administrators to execute arbitrary code or cause total system impact.

This vulnerability is a deserialization of untrusted data (CWE-502) flaw, which permits an authenticated administrator to inject malicious PHP objects. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms that while the attack is network-accessible and low-complexity, it requires high-level administrative privileges to trigger.

The ability to perform PHP object injection poses a severe risk to the confidentiality, integrity, and availability of the WordPress environment. Successful exploitation can lead to full site compromise, unauthorized data access, or the execution of arbitrary code, significantly threatening business operations and regulatory compliance. Given the CVSS score of 7.2, this vulnerability is classified as High severity and requires prompt attention.

Immediate Action: Update the Email Subscribers and Newsletters plugin to the latest version beyond 5.9.10 immediately. If an update is not yet available, deactivate the plugin until a secure version is released.

Proactive Monitoring: Monitor server logs for suspicious POST requests targeting the plugin directory or unusual PHP execution patterns. Review administrative access logs to identify any unauthorized or anomalous user activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized objects or suspicious input strings directed at plugin endpoints.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the Icegram Email Subscribers and Newsletters plugin must prioritize upgrading to the latest patched version to remediate this deserialization flaw. Because this vulnerability grants high-level impact to authenticated attackers, failing to apply updates could allow an attacker to escalate privileges or gain persistent control over the host server. Monitor vendor security channels for further guidance and patch availability.