CVE-2017-20206
Published: 18 October 2025
Summary
CVE-2017-20206 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wpmudev Appointments. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2017-20206 is a PHP Object Injection vulnerability in the Appointments plugin for WordPress, affecting versions up to and including 2.2.1. The flaw stems from deserialization of untrusted input from the `wpmudev_appointments` cookie, enabling attackers to inject arbitrary PHP objects. It is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely without privileges or user interaction. By crafting a malicious cookie, they can trigger object injection, leading to high-impact compromise of confidentiality, integrity, and availability. In real-world attacks, attackers leveraged the WP_Theme() class via this deserialization to create backdoors on vulnerable WordPress sites.
Advisories from Wordfence detail the active exploitation of this zero-day vulnerability in the wild and provide threat intelligence on the specific issue. Mitigation is addressed through a patch in the WordPress plugin trac changeset 1733186, which security practitioners should apply to affected installations of the Appointments plugin.
This vulnerability saw active exploitation shortly after disclosure, underscoring the dangers of untrusted deserialization in WordPress plugins and the rapid targeting of high-severity flaws in widely used components.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-18924
Vulnerability details
The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting…
more
this vulnerability with the WP_Theme() class to create backdoors.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of a public-facing WordPress plugin via crafted cookie leading to PHP object injection and backdoor creation, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information input validation directly prevents deserialization of untrusted data from the wpmudev_appointments cookie by ensuring malicious PHP objects are rejected.
Flaw remediation requires timely patching of the Appointments plugin vulnerability as detailed in trac changeset 1733186 to eliminate the deserialization flaw.
Vulnerability monitoring and scanning identifies the presence of CVE-2017-20206 in vulnerable WordPress plugin versions for prompt remediation.