Quick answers
- Is CVE-2026-97284 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-97284 being exploited in the wild.
- How severe is CVE-2026-97284?
- High severity, with a CVSS score of 8.8, published 1 October 2026.
- Which products and versions are affected?
- Icegram <= 3.1.31.
- Is there a fix for CVE-2026-97284?
- Yes: fixed in 3.1.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-97284 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-97284?
- Check whether you run Icegram at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.1.44
Technical details
The vulnerability is a PHP object injection (unserialization flaw) in the Icegram WordPress plugin affecting versions ≤ 3.1.31. An attacker with contributor-level privileges can manipulate serialized data to instantiate arbitrary objects, leading to remote code execution on the server. The attack requires authentication but operates at a low privilege level, making it a significant risk for sites with multiple user accounts.
Affected products
- Icegram Icegram <= 3.1.31
Timeline
- 2026-10-01: disclosed
- 2026-10-01: advisory