PHP Object Injection Vulnerability in Flickr Gallery Plugin for WordPress

CVE-2017-20207

What is CVE-2017-20207?

The Flickr Gallery plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to the deserialization of untrusted input from the pager parameter. This flaw affects versions up to 1.5.2 and allows unauthenticated attackers to inject malicious PHP Objects. Exploitation of this vulnerability can lead to the creation of backdoors via the WP_Theme() class, posing significant security risks to installations using the affected plugin.

References