Add WordPress < 3.6.1 PHP Object Injection

Vulnerability disclosed by Tom Van Goethem 
http://vagosec.org/2013/09/wordpress-php-object-injection/