WordPress Plugin Vulnerabilities

Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification

Description

The plugin does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.

Proof of Concept

Affects Plugins

Plugin icon
email-subscribers
Fixed in 5.9.35

References

CVE
CVE-2026-83555

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
54cb2a98-7860-40dd-817e-1294317084aa

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2024-09-04
Title
Geo Controller < 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion
Published
2025-12-11
Title
Email Subscribers & Newsletters < 5.9.11 - Unauthenticated Action Scheduler Task Execution
Published
2025-04-30
Title
Projectopia – WordPress Project Management < 5.1.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion
Published
2026-01-21
Title
Travel < 11.1.1 - Missing Authorization
Published
2025-10-10
Title
Newsup < 5.0.11 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation