The vulnerability CVE-2025-66055 affects the Icegram Email Subscribers & Newsletters plugin (versions up to 5.9.10) and is caused by deserialization of untrusted data, enabling object injection. This type of vulnerability can allow attackers with high privileges to execute arbitrary code or manipulate application logic, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on all security properties. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including disclosure of sensitive information, unauthorized modification of data, and disruption of service. The attack requires the attacker to have high privileges on the system, and it can be executed remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit privileges to trusted users only. Monitor for updates from the vendor and apply patches promptly once available.