The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress contains a missing authentication vulnerability (CWE-306) in the run_action_scheduler_task function. Versions up to and including 5.9.10 do not properly verify user authorization before executing scheduled tasks. This allows unauthenticated attackers to guess action IDs and execute scheduled actions early or multiple times, potentially triggering email sends or maintenance operations without permission. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits in the wild have been reported. Patch status is not confirmed; no vendor advisory or patch links are provided.

An attacker can execute scheduled tasks without authentication by guessing action IDs, leading to unauthorized triggering of email sends, maintenance tasks, or other privileged plugin operations. This may cause unexpected changes in system state and increased resource usage. There is no direct confidentiality or availability impact reported, but integrity may be affected due to unauthorized task execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin's functionality or disabling the plugin if feasible to prevent exploitation. Monitor for updates from the vendor and apply patches promptly once released.