What is the CVSS score of EUVD-2026-90840?

EUVD-2026-90840 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Icegram are affected by EUVD-2026-90840?

The Icegram WordPress plugin, deployed on sites through version 3.1.31, carries a high-severity flaw that could allow a low-privilege authenticated user to take control of site data and…

How to fix or mitigate EUVD-2026-90840?

Within 24 hours, inventory all WordPress sites running the Icegram plugin through version 3.1.31 and disable or uninstall the plugin on any site where it is not business-critical; simultaneously review user accounts and remove or downgrade any Contributor-equivalent or self-service roles that are not strictly required. Within 7 days, for sites where the plugin must remain active, enforce least privilege by eliminating unnecessary low-privilege accounts, disable open registration or delegated content creation, deploy WAF rules that detect and block PHP object injection and crafted serialized payloads, and enable enhanced logging for deserialization and plugin-related activity. Within 30 days, continue monitoring vendor channels for a patched version of Icegram and, once released, test and deploy it promptly; if no patch is issued, conduct a formal risk assessment to determine whether the plugin can be permanently removed or replaced, and perform a retrospective review of role-assignment and third-party plugin governance to prevent similar exposures.

Icegram EUVD-2026-90840

| CVE-2026-97284 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-10-01 Patchstack

GHSA-r26j-qwj4-rvc3

PHP WordPress Deserialization Wordpress Plugin Icegram

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 01, 2026 - 15:06 vuln.today

CVE Published

Oct 01, 2026 - 14:34 cve.org

HIGH 8.8

DescriptionCVE.org

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

AnalysisAI

PHP object injection in the Icegram WordPress plugin through version 3.1.31 allows an authenticated attacker holding only low-level (Contributor-equivalent) privileges to pass crafted serialized data into an unsafe PHP deserialization path, with the potential to trigger a gadget chain that yields high confidentiality, integrity, and availability impact. The flaw is network-reachable, low complexity, and requires no victim interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), and because the vulnerable component is a widely deployable WordPress plugin, any site allowing self-service or delegated content roles expands its exposure surface. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Vulnerability AssessmentAI

Risk Assessment

CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, with full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.

Remediation

No vendor-released patch identified at time of analysis: the supplied intelligence contains no fixed version number, no GitHub PR or commit, and no vendor patch reference beyond the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/icegram/vulnerability/wordpress-icegram-plugin-3-1-31-php-object-injection-vulnerability?_s_id=cve, which should be monitored for a corrected release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress sites running the Icegram plugin through version 3.1.31 and disable or uninstall the plugin on any site where it is not business-critical; simultaneously review user accounts and remove or downgrade any Contributor-equivalent or self-service roles that are not strictly required. …

Threat intelligence, references, and detailed analysis are available after sign-in.