← Back

CVE-2017-20206

nvd nist
Published: Oct 18, 2025Modified: Dec 23, 2025

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: security@wordfence.com (Secondary)

Description

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

Affected (1)

Wpmudev
1 product
Appointments
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Appointments
Up to 2.2.1

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

Source: security@wordfence.com
Patch
Source: security@wordfence.com
Press/Media CoverageThird Party Advisory
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.