The post-pay-counter plugin prior to 2.731 for WordPress has PHP Object Injection.
post pay counter project post pay counter