WPMU Dev Appointments WordPress Plugin PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the WPMU Dev Appointments WordPress plugin, affecting versions through 2.2.1. The vulnerability arises from the deserialization of untrusted data in the 'wpmudev_appointments' cookie, allowing unauthenticated attackers to inject PHP objects. Exploitation of this vulnerability was observed in the wild, with attackers using the WP_Theme() class to create backdoors on the affected sites.

Impact

Exploitation of this vulnerability allows for PHP Object Injection, which can be used to execute arbitrary code or create backdoors on the affected site, potentially leading to a full takeover of the website.

Remediation

Users of the WPMU Dev Appointments WordPress plugin should update to version 2.2.2 or a newer patched version.