The Flickr Gallery plugin for WordPress, a tool designed to easily embed Flickr photos and galleries, was found to have a critical security flaw. This vulnerability, identified as CVE-2017-20207, allowed attackers to take control of affected websites.
This wasn’t just a theoretical risk; attackers were actively exploiting this loophole. They were using it to inject malicious PHP objects, effectively creating backdoors on compromised WordPress sites. This could lead to severe consequences, including full site compromise.
The core of the problem lay in how the plugin handled certain user inputs. Specifically, it used a function called unserialize() on data received through the pager parameter without properly checking if that data was safe. This opened the door for what is known as a PHP Object Injection vulnerability. Attackers leveraged this to introduce harmful PHP objects, which were then processed by the server, allowing them to execute arbitrary code. One known method of exploitation involved using the WP_Theme() class to establish persistent backdoors.
CVE Details
- Product: Flickr Gallery plugin for WordPress
- CVE ID: CVE-2017-20207
- Published Date: October 18, 2025
- Severity: Critical
- Status: Analyzed
Affected Products
The Flickr Gallery plugin for WordPress versions up to, and including, 1.5.2 are vulnerable. If you are running any version 1.5.2 or earlier, your website is at risk.
Current Status
This vulnerability has been thoroughly analyzed. A patch was released in version 1.5.3 to address the specific PHP Object Injection flaw. However, the developers have since deprecated the entire plugin, indicating it is no longer supported and should be removed from all WordPress installations. An administrative notice is displayed to users of affected versions, advising uninstallation.
Severity Level
The vulnerability has been assigned a CVSS score of 9.8, categorizing it as Critical severity. This high rating reflects the ease of exploitation (unauthenticated attackers can exploit it remotely) and the severe impact, allowing for complete compromise of the affected system, including arbitrary code execution and backdoor creation.
Possible Solutions
The most crucial step for users of the Flickr Gallery plugin is to immediately update to version 1.5.3 or higher. Version 1.5.3 specifically removes the insecure unserialize() call that led to this vulnerability.
However, given that the plugin has been officially deprecated, the strongest recommendation is to uninstall the Flickr Gallery plugin entirely and seek a modern, actively maintained alternative for embedding Flickr content. Continuing to use a deprecated plugin, even if a critical vulnerability is patched, carries inherent risks as it will no longer receive security updates for future issues.
Always ensure your WordPress core, themes, and all plugins are kept up-to-date to protect against known vulnerabilities. Regularly back up your website to ensure you can recover quickly in case of a security incident.
References
https://plugins.trac.wordpress.org/changeset/1737576/flickr-gallery
https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/
https://www.wordfence.com/threat-intel/vulnerabilities/id/b52ae51d-7b9a-4047-82bf-723ea87d2375?source=cve
