CVE-2017-20206

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

• CWE-502

• https://plugins.trac.wordpress.org/changeset/1733186/appointmentsPatch
• https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/Press/Media Coverage, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8f230e-3f96-4efd-806d-72725b960303?source=cveThird Party Advisory

Published

Oct 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-20200A vulnerability has been found in Coinomi up to 1.7.6. This …3.7
• CVE-2017-20201CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 (32-bit bu…9.3
• CVE-2017-20202Web Developer for Chrome v0.4.9 contained malicious code tha…9.3
• CVE-2017-20203NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 B…9.3
• CVE-2017-20204DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contai…9.3
• CVE-2017-20205Valve's Source SDK (source-sdk-2013)'s ragdoll model parsing…9.2
• CVE-2017-20207The Flickr Gallery plugin for WordPress is vulnerable to PHP…9.8
• CVE-2017-20208The RegistrationMagic – Custom Registration Forms, User Regi…9.8
• CVE-2017-20209Nagios Fusion versions prior to 4.0.1 are vulnerable to cros…6.1
• CVE-2017-2021Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-20210Photo Station 5.4.1 & 5.2.7 include the security fix for the…9.8
• CVE-2017-20211UCanCode E-XD++ Visualization Enterprise Suite contains an u…8.6