CVE-2012-0934 Theme Tuner < 0.8 - Remote File Inclusion
HighCVSS 7.5
EPSS 8.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zingiri theme tuner plugin | <= 0.7 | No fix listed |
| zingiri theme tuner plugin | = 0.1 | No fix listed |
| zingiri theme tuner plugin | = 0.2 | No fix listed |
| zingiri theme tuner plugin | = 0.3 | No fix listed |
| zingiri theme tuner plugin | = 0.4 | No fix listed |
| zingiri theme tuner plugin | = 0.6 | No fix listed |
| wordpress theme-tuner(WordPress) | < 0.8 | 0.8 |
References
- plugins.trac.wordpress.org
- 47722 third-party-advisory vendor-advisory
- spareclockcycles.org exploit
- wordpress.org patch
- 51636 vdb-entry
- themetuner-savetag-file-include(72626) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org