CVE-2017-20206
Published: 18 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2017-20206 is a PHP Object Injection vulnerability in the Appointments plugin for WordPress, affecting versions up to and including 2.2.1. The flaw stems from deserialization of untrusted input from the `wpmudev_appointments` cookie, enabling attackers to inject arbitrary PHP objects. It is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely without privileges or user interaction. By crafting a malicious cookie, they can trigger object injection, leading to high-impact compromise of confidentiality, integrity, and availability. In real-world attacks, attackers leveraged the WP_Theme() class via this deserialization to create backdoors on vulnerable WordPress sites.
Advisories from Wordfence detail the active exploitation of this zero-day vulnerability in the wild and provide threat intelligence on the specific issue. Mitigation is addressed through a patch in the WordPress plugin trac changeset 1733186, which security practitioners should apply to affected installations of the Appointments plugin.
This vulnerability saw active exploitation shortly after disclosure, underscoring the dangers of untrusted deserialization in WordPress plugins and the rapid targeting of high-severity flaws in widely used components.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of a public-facing WordPress plugin via crafted cookie leading to PHP object injection and backdoor creation, directly mapping to T1190: Exploit Public-Facing Application.