CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.
Explanation of Vulnerability in Simple Terms
The Appointments plugin for WordPress contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The vulnerability exists in versions before 2.2.2 and requires no user interaction. An attacker can exploit this by sending a specially crafted request to deserialize untrusted data, leading to remote code execution with full site compromise.
What an attacker can do
Run arbitrary code on your site and take complete control of it.
Potential impact on your site
Complete site compromise, data theft, malware injection, and loss of site control.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
