Icegram Express Pro CVE-2025-49917

Exploitation requires an authenticated, high-privilege account (PR:H) on a WordPress site running Icegram Express Pro (email-subscribers-premium) version 5.9.5 or earlier, combined with high attack complexity (AC:H) meaning additional conditions beyond attacker control must be satisfied. The flaw is reached through plugin functionality that performs a server-side fetch of an attacker-influenced URL. Limiting factors: the requirement for high-level authentication substantially narrows the attacker pool to trusted/admin-level users (or a compromised such account), and the AC:H rating indicates the attack is not reliably reproducible under all conditions. The exact vulnerable feature is not specified in the available data and should be confirmed with the Patchstack advisory.

This is a low-to-moderate priority issue despite being a server-side request forgery (CWE-918). The CVSS 3.1 base score is 4.4 (Medium), and the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N shows the practical barriers clearly: although the attack vector is network-based, it requires high privileges (PR:H - authenticated administrative/high-level access), high attack complexity (AC:H), and yields only low confidentiality and integrity impact with no availability impact. EPSS reinforces the low-urgency picture at 0.21% (10th percentile), indicating a very low modeled probability of exploitation. There is no CISA KEV listing and no publicly identified exploit code. No SSVC decision data was provided in the input. The signals are mutually consistent rather than conflicting - a high-privilege, high-complexity, medium-severity flaw in a WordPress plugin with low exploitation probability. The main point worth verifying: the given vector lists Scope:Changed with C:L/I:L, which is typical for SSRF reaching internal/adjacent systems, but the actual blast radius depends on what internal services are reachable from the WordPress host.

An attacker who already holds a high-privilege (e.g., administrator) account on a WordPress site running Icegram Express Pro <= 5.9.5 abuses a plugin feature that fetches a user-supplied URL server-side, coercing the server into making requests to internal or otherwise restricted endpoints. This could be used to probe internal network services or metadata endpoints reachable from the web server. No public exploit code has been identified at the time of analysis, and the high attack complexity (AC:H) implies additional conditions must be met.