Icegram Engage <= 3.1.43 - Authenticated (Contributor+) PHP Object Injection via 'messages' Custom Field
- ID
- WPSEC-2026-0311
- Plugin
- Icegram Engage – Popups, Optins, CTAs & Lead Generation (icegram)
- Affected
- all versions before 3.1.44
- Remediation
- Update to 3.1.44 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Icegram Engage on WPSec AttackSurface
- Fix released
- Published
Description
The Icegram Engage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.43 via deserialization of untrusted input from the 'messages' post meta field when a campaign or message is duplicated. The duplication routine passes the raw stored meta value to PHP's unserialize() without restricting allowed classes. This makes it possible for authenticated attackers with contributor-level access and above, who can add custom fields to a post they can edit, to inject a PHP object. No known POP chain is present in the vulnerable software itself. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0311/
- https://plugins.svn.wordpress.org/icegram/tags/3.1.44/
- https://wordpress.org/plugins/icegram/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS