CVE-2012-0934

EUVD-2012-0957
PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
Affected Products (NVD)
VendorProductVersion
zingiritheme_tuner_plugin
𝑥
≤ 0.7
zingiritheme_tuner_plugin
0.1
zingiritheme_tuner_plugin
0.2
zingiritheme_tuner_plugin
0.3
zingiritheme_tuner_plugin
0.4
zingiritheme_tuner_plugin
0.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://plugins.trac.wordpress.org/changeset/492167/theme-tuner#file2
http://secunia.com/advisories/47722
http://spareclockcycles.org/2011/09/18/exploitring-the-wordpress-extension-repos/
http://wordpress.org/extend/plugins/theme-tuner/changelog/
http://www.securityfocus.com/bid/51636
https://exchange.xforce.ibmcloud.com/vulnerabilities/72626
http://plugins.trac.wordpress.org/changeset/492167/theme-tuner#file2
http://secunia.com/advisories/47722
http://spareclockcycles.org/2011/09/18/exploitring-the-wordpress-extension-repos/
http://wordpress.org/extend/plugins/theme-tuner/changelog/
http://www.securityfocus.com/bid/51636
https://exchange.xforce.ibmcloud.com/vulnerabilities/72626