CVE-2017-20206

CRITICAL

Appointments <= 2.2.1 - Unauthenticated PHP Object Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2017-20206 has a selected CVSS score of 9.8 (critical).

Description

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 2, 2017 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 20, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Appointments Plugin for WordPress

Browse WPMU Dev / Appointments Plugin for WordPress
VulnCheckVersion data not supplied

Appointments

Browse wpmudev / Appointments

Default status: unaffected

CVE ListBefore 2.2.2affected

References

4