CVE-2015-6828 WordPress SecureMoz Security Audit Plugin tweet_info() PHP Object Injection Vulnerability

WordPress is an open source blogging tool and content management system based on PHP and MySQL. It has many features including a plug-in architecture and a template system. SecureMoz Security Audit WordPress Security Plugin performs a security audit to detect PHP and WordPress vulnerabilities and solve them.

The tweet_info() function in the implemeted class__functions.php source file fails to use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream.

Affected Versions:
SecureMoz Security Audit plugin for WordPress 1.0.5 and prior

Successful exploitation allows remote attackers to carry out which allows man-in-the-middle attacks, which can be further leveraged to conduct PHP object injection attacks and execute arbitrary PHP code.

Customers are advised to install WordPress plugin SecureMoz Security Audit 1.0.6 or later versions to fix this vulnerability.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

SecureMoz Security Audit 1.0.6 or later