CVE-2026-97284

Executive Summary

CVE-2026-97284 is a PHP Object Injection vulnerability in the Icegram WordPress plugin affecting all versions up to and including 3.1.31. The flaw is classified as CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 8.8 (High). It is remotely exploitable over the network by an authenticated user with low privileges and, when successfully leveraged, can lead to full compromise of confidentiality, integrity, and availability of the affected site.

Icegram is a WordPress plugin used for email opt-in forms, popups, and call-to-action campaigns, and is deployed on a potentially large number of publicly accessible WordPress sites. Because the vulnerability allows object injection, an attacker who can supply untrusted input to an unsafe deserialization path can instantiate arbitrary PHP objects and, if a suitable gadget chain is present in the loaded codebase or its dependencies, escalate to remote code execution or perform file operations, data exfiltration, or authentication bypass.

Two factors raise the risk profile of this CVE: first, no official patch is available for the plugin at the time of writing (patch confidence 0/4), meaning the entire installed base running 3.1.31 or earlier remains exposed; second, the "Contributor" component referenced in the title suggests the attack vector is available to low-privileged authenticated users, which significantly lowers the barrier to exploitation compared to an unauthenticated flaw. At the same time, there is currently no public proof of concept, no Nuclei template, and no evidence of exploitation in the wild, so organizations still have a brief window to remediate before public tooling appears.

Technical Analysis

The root cause of CVE-2026-97284 is unsafe deserialization of user-controlled data: an untrusted input string is passed to a PHP unserialize() operation (or an equivalent construct that triggers object instantiation, such as a PHAR metadata deserialization triggered through file operations), permitting PHP Object Injection. This class of bug, mapped to CWE-502, arises when an application reconstructs a PHP object from attacker-supplied serialized data without validation, allow-listing of classes, or the use of safer formats such as JSON.

In an object injection attack, the attacker constructs a serialized string whose contents instruct the PHP runtime to instantiate one or more classes with attacker-controlled properties. The direct impact of merely instantiating an object is usually benign; the danger comes from the magic methods (__wakeup, __destruct, __toString, __call, and others) that execute automatically when the object is reconstructed or destroyed. By chaining objects whose magic methods invoke each other — the so-called POP (Property-Oriented Programming) gadget chain — an attacker can transform "instantiate this object" into arbitrary file read/write, SQL execution, or command execution, depending on the classes reachable within the affected codebase. The CNA title indicates that the vulnerable component is part of the Icegram plugin, but the provided NVD description does not disclose the exact function, parameter, or file path that carries the insecure unserialize() call; those details remain unavailable and must not be assumed.

The attack surface is exposed over the network (CVSS AV:N) through a legitimate, low-privileged authenticated session (PR:L) with no user interaction required (UI:N). Because WordPress administrators frequently expose public-facing fields — forms, tracking parameters, AJAX handlers — and because many plugins are installed alongside others that ship their own magic-method gadget classes, the practical exploitability of an object injection flaw depends both on reachability of the vulnerable endpoint and on the presence of a working gadget chain. Icegram's feature set (email capture, popups, campaign forms) implies the plugin accepts user input in multiple contexts, but the precise endpoint(s) involved in CVE-2026-97284 cannot be confirmed from the intelligence provided. The CVSS subscores (C:H/I:H/A:H) confirm that successful exploitation is assumed to grant full control over the site's confidentiality, integrity, and availability — consistent with code execution or equivalent total compromise.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level because no public PoC exists and the NVD description does not expose the specific implementation details of the flawed deserialization path. No function names, file paths, or parameters beyond those in the advisory are assumed.

1. Reconnaissance and target identification. The attacker identifies internet-facing WordPress installations that run the Icegram plugin at version 3.1.31 or earlier. This can be done passively or actively: inspecting public HTML for plugin assets/strings, querying public search engines or Shodan using the dorks above, or exploiting common WordPress REST/plugin fingerprints. The attacker also enumerates whether a low-privileged account (e.g., a contributor-level user) can be obtained or is already available, since the vulnerability requires only low privileges.

2. Triggering the flaw class. Once a low-privileged session and a reachable input path are established, the attacker supplies a crafted serialized PHP object to the component that performs insecure deserialization. The injection occurs at the moment the application converts the attacker-controlled string back into PHP objects — either through an explicit unserialize() call on request data, or through a file operation that reads attacker-influenced PHAR metadata whose serialized manifest is deserialized by the PHP runtime. The precise request element used to deliver the payload is not specified in the available intelligence.

3. Payload and execution (vulnerability-class level). The payload is a serialized string encoding one or more PHP objects whose properties are chosen to steer execution into magic methods (__wakeup, __destruct, __toString, etc.) that exist within the plugin or within other loaded classes; the attacker chains these "gadgets" so that the terminal gadget performs a dangerous action — for example, writing arbitrary content to disk, reading sensitive files, or executing a system command. Without a published gadget chain for this plugin, the attacker would need to develop one by auditing the codebase, which raises the required skill but does not eliminate the risk; object injection commonly becomes RCE once any viable chain is found.

4. Post-exploitation impact. Successful exploitation yields effects consistent with the CVSS scores C:H/I:H/A:H: full read access to the site's data (including the WordPress database and its user credentials), the ability to modify or delete content and inject webshells or malicious JavaScript, and disruption or denial of service. On a WordPress site this is commonly leveraged for lateral movement into the hosting environment, credential theft, SEO poisoning, or distribution of further malicious payloads to site visitors.

At present, there is no public PoC, no exploit code, and no Nuclei template for CVE-2026-97284, and no evidence of in-the-wild exploitation. Organizations should treat the absence of public tooling as a time-limited advantage: object injection flaws are frequently weaponized once researchers publish gadget chains, and the absence of a patch means the vulnerable code will remain reachable after PoCs emerge.

Impact Assessment

The business impact of CVE-2026-97284 is high where the Icegram plugin is exposed. A CVSS v3.1 base score of 8.8 places it in the High severity band. The subscores indicate:

• Confidentiality (High): an attacker who converts object injection into arbitrary file read or code execution can retrieve database credentials, user password hashes, private customer data captured by opt-in forms (email addresses and potentially names), and other sensitive configuration data.
• Integrity (High): the attacker can modify site content, inject persistent malicious scripts served to visitors, alter or delete captured leads, and plant webshells or backdoors for persistent access.
• Availability (High): an attacker can disrupt the site, corrupt data, or render the affected plugin and dependent functionality unusable.
• Scope (Unchanged): the impact is confined to the vulnerable WordPress component's security authority, though in practice compromise of one plugin typically affects the whole site.

The blast radius includes any WordPress site running Icegram <= 3.1.31 with a reachable attack path and a source of low-privileged accounts. Because WordPress sites are frequently integrated with CRM, marketing automation, and third-party services, a compromise can propagate to subscribers via malicious emails, poisoned forms, or harvested email lists. The absence of a patch means there is no fixed version to migrate to; mitigation must rely on removing, disabling, or virtual-patching the plugin until the vendor issues a fix. EPSS has not yet scored this CVE, so no probabilistic exploitation estimate is available.

Detection Guidance

Sigma Rule

title: Possible PHP Object Injection Attempt Against Icegram Plugin
id: 9f3c2b1a-7d4e-4c8a-9b6f-2a1e5d7c4b30
status: experimental
description: Detects suspicious serialized PHP object payloads (O: or C: notation) in HTTP requests targeting WordPress endpoints, consistent with CWE-502 exploitation against Icegram <= 3.1.31.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97284
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - POST
      - GET
  selection_payload:
    - cs-uri-query|contains:
        - 'O:'
        - 'C:'
    - cs-uri-query|re: '(?i)(O|C):[0-9]+:"[A-Za-z_\\]+":'
  selection_plugin:
    cs-uri-query|contains: 'icegram'
  condition: selection_method and selection_payload and selection_plugin
falsepositives:
  - Legitimate serialized data in application traffic
  - Caching or search parameters that contain the string 'O:'
level: high
tags:
  - attack.t1190
  - cwe.502

YARA Rule

rule CVE_2026_97284_Icegram_Object_Injection
{
    meta:
        description = "Detects serialized PHP object payloads consistent with PHP Object Injection (CWE-502) targeting the Icegram plugin <= 3.1.31"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97284"
        date = "2026-01-01"
        severity = "high"

    strings:
        $php_serialized_object = /O:[0-9]{1,4}:"[A-Za-z_\\\\]{1,128}":[0-9]{1,4}:\{/
        $php_serialized_custom = /C:[0-9]{1,4}:"[A-Za-z_\\\\]{1,128}":[0-9]{1,6}:\{/
        $icegram = "icegram" nocase

    condition:
        filesize < 2MB and
        ($php_serialized_object or $php_serialized_custom) and
        #icegram > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97284 Possible PHP Object Injection Attempt - Icegram Plugin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"icegram"; nocase; http.request_body; pcre:"/O:\d+:\"[A-Za-z_\\\\]+\":\d+:\{/"; reference:cve,2026-97284; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97284; classtype:web-application-attack; sid:202697284; rev:1; metadata:affected_product WordPress, attack_target Web_Server, created_at 2026_01_01, cve CVE_2026_97284, deployment Perimeter, signature_severity Major, tag CWE_502;)

Elastic Detection

network where
  http.request.method == "POST" and
  stringContains(to_lowercase(url.path), "icegram") and
  (
    stringContains(url.query, "O:") or
    stringContains(url.query, "C:")
  )

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| search (uri_path="*icegram*" OR uri_query="*icegram*")
| search (uri_query="*O:*\"*\"" OR form_data="*O:*\"*\"")
| eval risk="CVE-2026-97284 potential PHP object injection"
| table _time, src_ip, dest, uri_path, uri_query, http_method, status, risk
| sort - _time

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-97284,">
  <rule id="100284" level="12">
    <if_sid>31100</if_sid>
    <id>^29</id>
    <match>icegram</match>
    <regex>O:\d+:"[A-Za-z_\\]+":|C:\d+:"[A-Za-z_\\]+":</regex>
    <description>Possible exploitation of CVE-2026-97284 - PHP Object Injection in Icegram plugin (CWE-502)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97284,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence is available from any tracked source, and no vendor fix or workaround has been published. Until the developer releases a fixed version, the following actions are recommended.

1. Immediate mitigations

• Treat all sites running Icegram <= 3.1.31 as vulnerable. If the plugin is not strictly required, deactivate and remove it. On high-value sites where removal is impractical, disable non-essential Icegram functionality and restrict access to its administrative and public submission endpoints.
• Enforce least privilege: audit low-privileged accounts (especially contributor-level users) and remove or downgrade accounts that are not needed, since the vulnerability requires only low privileges (PR:L). Enable strong authentication for all WordPress accounts.
• Reduce the attack surface with a WAF or virtual patching, blocking requests that carry serialized PHP object signatures (O:/C: notation) to plugin or REST endpoints. Note that this is a detection/temporary control, not a fix, and can be bypassed with encoding or alternate gadget encodings.
• Deploy network and host monitoring (the rules above) to alert on object-injection-style payloads, and monitor for the file and process activity that would follow successful code execution.

2. Patch and upgrade steps

• There is currently no patched release. Track the Icegram official changelog and the WordPress.org plugin repository for a version above 3.1.31 that explicitly addresses CWE-502 / object injection. Do not assume a release fixes this issue unless the changelog confirms it.
• When a fixed version is published, update the plugin through the standard WordPress update mechanism and verify the installed version. If the plugin is managed by a host or agency, require written confirmation of the patched version.
• Because no CVE-specific patch exists, review the plugin's serialized-data handling and the surrounding codebase against a hardening checklist: ensure user input is never passed to unserialize(), prefer JSON or other safe formats, and use class allow-lists where PHP object reconstruction is unavoidable.

3. Long-term hardening

• Maintain a complete software bill of materials for all WordPress plugins and themes, with version tracking and alerting so that unpatched components are removed or replaced quickly.
• Apply defense in depth: WordPress-level permissions hardening (disallow file editing, enforce strong salts and keys), PHP configuration hardening (disable dangerous functions where feasible, restrict file permissions), and routine security monitoring on both web and host layers.
• Include WordPress plugin vulnerabilities in patch SLAs; because CWE-502 issues often escalate to RCE once gadget chains surface, treat unpatched object injection findings as high priority even before public exploit code exists.
• Continuously monitor NVD, the WordPress plugin repository, and vendor advisories for the release of a fixed Icegram version and update the patch status for CVE-2026-97284 accordingly.

References

• NVD — CVE-2026-97284: https://nvd.nist.gov/vuln/detail/CVE-2026-97284
• CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Icegram plugin (WordPress.org) — changelog and version tracking: https://wordpress.org/plugins/icegram/
• CISA — WordPress security best practices / hardening guidance: https://www.cisa.gov/ (WordPress hardening resources) — KEV status: not listed.
• Exploit-in-the-wild evidence: none identified at time of writing. No public PoC, no Nuclei template, and no known threat actor campaign has been associated with CVE-2026-97284 in the data provided.