The Icegram Express plugin for WordPress contains an authorization bypass vulnerability (CWE-306) in the trigger_mailing_queue_sending function. This flaw allows unauthenticated users to trigger immediate email dispatch, circumventing intended scheduling controls. The vulnerability affects all versions up to 5.9.10. Exploitation can lead to increased server load and manipulation of plugin state variables such as last-cron-hit, potentially enabling abuse or denial-of-service conditions. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

Exploitation enables unauthenticated attackers to bypass email scheduling controls, forcing immediate email sending. This can increase server load and alter plugin internal state, potentially leading to denial-of-service-like conditions or abuse of the email sending functionality. There is no direct impact on confidentiality or availability reported.

No official patch or fix information is currently available. Users should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until a fix is released, consider disabling or restricting access to the affected plugin functionality to trusted users only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.