CVE-2017-20207 Flickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection
CriticalCVSS 9.8
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the pager parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dan Coulter Flickr Gallery | < 1.5.3 | 1.5.3 |
| dancoulter flickr gallery | <= 1.5.2 | No fix listed |
| wordpress flickr-gallery(WordPress) | < 1.5.3 | 1.5.3 |
References
- www.wordfence.com third-party-advisory
- www.wordfence.com press-media-coverage third-party-advisory
- plugins.trac.wordpress.org patch
- Wordfence Intelligence third-party-advisory
- www.cve.org