PHP Object Injection Vulnerability in Appointments Plugin for WordPress
CVE-2017-20206
9.8CRITICAL
What is CVE-2017-20206?
The Appointments plugin for WordPress is susceptible to PHP Object Injection due to improper deserialization of untrusted data from the wpmudev_appointments cookie in versions 2.2.1 and earlier. This misuse allows attackers to inject malicious PHP objects, potentially enabling them to create backdoors within the application. Attackers have been observed exploiting this vulnerability through the WP_Theme() class, reinforcing the necessity for swift patching and security measures to safeguard WordPress implementations.
Affected Version(s)
Appointments * < 2.2.2