CVE-2017-20206
📋 TL;DR
The Appointments plugin for WordPress has a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by deserializing malicious data from cookies. This affects all WordPress sites running Appointments plugin version 2.2.1 or earlier. Attackers were actively exploiting this to create backdoors using the WP_Theme() class.
💻 Affected Systems
- WordPress Appointments Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing remote code execution, backdoor installation, data theft, and website defacement.
Likely Case
Backdoor installation leading to persistent unauthorized access, data exfiltration, and further malware deployment.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though the vulnerability still exists.
🎯 Exploit Status
Actively exploited in the wild with known payloads targeting WP_Theme() class for backdoor creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.2
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/1733186/appointments
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Appointments plugin. 4. Click 'Update Now' if available. 5. If not, download version 2.2.2+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the Appointments plugin until patched to prevent exploitation.
wp plugin deactivate appointments
Cookie Validation
allImplement web application firewall rules to block or sanitize wpmudev_appointments cookie values.
🧯 If You Can't Patch
- Disable the Appointments plugin immediately
- Implement strict WAF rules to block malicious cookie payloads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Appointments version. If version is 2.2.1 or lower, you are vulnerable.Check Version:
wp plugin get appointments --field=versionVerify Fix Applied:
Verify Appointments plugin version is 2.2.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with wpmudev_appointments cookie
- PHP unserialize errors in logs
- Unexpected file creation in wp-content/themes
Network Indicators:
- HTTP requests with serialized PHP objects in cookies
- Traffic to known exploit domains
SIEM Query:
source="wordpress.log" AND "wpmudev_appointments" AND ("unserialize" OR "WP_Theme")