This host is running WordPress and is prone to remote file inclusion vulnerability.

Successful exploitation will allow attacker to compromise the application and the underlying system other attacks are also possible. Impact Level: System/Application

Upgrade to WordPress Theme Tuner Plugin version 0.8 or later. For updates refer to http://wordpress.org/extend/plugins/theme-tuner/

The flaw is due to improper validation of user-supplied input to the 'tt-abspath' parameter in '/ajax/savetag.php', which allows attackers to execute arbitrary PHP code.

WordPress Theme Tuner Plugin version 0.7 and prior

• http://osvdb.org/show/osvdb/78457
• http://secunia.com/advisories/47722
• http://spareclockcycles.org/2011/09/18/exploitring-the-wordpress-extension-repos
• http://wordpress.org/extend/plugins/theme-tuner/changelog
• http://xforce.iss.net/xforce/xfdb/72626

---

Updated on 2017-03-28