Add WordPress < 3.6.1 PHP Object Injection

This security issue is disclosed by Tom Van Goethem http://vagosec.org/2013/09/wordpress-php-object-injection/