1
The WordPress Function maybe_unserialize() Won't Prevent PHP Object Injection
(www.pluginvulnerabilities.com)
Discussion about WordPress security without all the falsehoods.