Critical severity9.8NVD Advisory· Published Oct 18, 2025· Updated Jun 17, 2026
CVE-2017-20207
CVE-2017-20207
Description
The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the pager parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Dan Coulter/Flickr Galleryv5Range: 0
- Range: <=1.5.2
Patches
Vulnerability mechanics
References
3- plugins.trac.wordpress.org/changeset/1737576/flickr-gallerynvdPatch
- www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/nvdPress/Media CoverageThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/b52ae51d-7b9a-4047-82bf-723ea87d2375nvdThird Party Advisory
News mentions
0No linked articles in our index yet.