CVE-2007-4181: PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enable...

Security readout for executives and security teams

This is an old, disputed report about Pluck 4.3. If real, it would let an attacker run PHP code through a remote file include when PHP register_globals is enabled. The source bundle also includes a third-party dispute saying the claimed HTTP parameter does not reach the include path. Relevant exposure appears limited to legacy Pluck 4.3 deployments on PHP configurations with register_globals enabled. Even then, the source bundle contains conflicting evidence about whether the HTTP-controlled dir parameter can affect the include. Low immediate urgency unless the organization still runs legacy Pluck 4.3. Because exploitability is disputed and no active exploitation is cited, prioritize inventory and retirement of obsolete PHP applications rather than emergency response. Mitigation focus: Inventory any remaining Pluck 4.3 deployments and internet exposure.; Check Pluck or maintainer guidance before assuming a specific patch path.; Disable register_globals where applicable in legacy PHP environments..

Prepared

Jun 29, 2026, 04:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.