CVE-2017-20206 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from…
Critical CVSS: 9.8

CVE-2017-20206

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.
Vendor
Wpmudev
Product
Appointments
CWE
CWE-502
Yayın Tarihi
2025-10-18 04:15:43
Güncelleme
2025-12-23 17:06:57
Source Identifier
security@wordfence.com
KEV Date Added
-

Kategoriler

CWE-502 Appointments CRITICAL Wpmudev 2025

Referanslar

https://plugins.trac.wordpress.org/changeset/1733186/appointments https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/ https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8f230e-3f96-4efd-806d-72725b960303?source=cve