← Back

CVE-2017-20207

nvd nist
Published: Oct 18, 2025Modified: Jan 5, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: security@wordfence.com (Secondary)

Description

The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the `pager ` parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

Affected (1)

Dancoulter
1 product
Flickr Gallery
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Flickr Gallery
Up to 1.5.2

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

Source: security@wordfence.com
Patch
Source: security@wordfence.com
Press/Media CoverageThird Party Advisory
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.