CVE-2017-20206

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 2.2.1 . The root cause is the deserialization of untrusted input from the wpmudev_appointments cookie, which allows unauthenticated attackers to inject a PHP Object. Historically, attackers...