WPMU DEV Vulnerabilities and Affected Products
Vulnerabilities associated with Appointments Plugin for WordPress.
Products
Clear product- Forminator8 vulnerabilities
- Defender Security3 vulnerabilities
- Appointments Plugin for WordPress1 vulnerability
- Branda1 vulnerability
- Branda plugin for WordPress1 vulnerability
- Broken Link Checker1 vulnerability
- Defender Security – Malware Scanner, Login Security & Firewall1 vulnerability
- Hustle1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2017-20206CRITICAL | Appointments <= 2.2.1 - Unauthenticated PHP Object InjectionThe Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors. CWE-502Oct 18, 2025 | CVSS9.8v3.1 | EPSS0.685% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |