CVE-2017-20207

9.8 criticalEPSS 0.7%

Critical (9.8) in dancoulter flickr gallery. EPSS 0.7% chance of exploitation in the next 30 days.

The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the `pager ` parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2025-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dancoulter:flickr_gallery

References

https://plugins.trac.wordpress.org/changeset/1737576/flickr-gallery
https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/
https://www.wordfence.com/threat-intel/vulnerabilities/id/b52ae51d-7b9a-4047-82bf-723ea87d2375?source=cve

Check your stack JSON