Okay, first off, that’s an incredibly badly made theme. Your item number 2 there indicates to me that he making AJAX calls in entirely the wrong way.
Secondly, look for anything in the theme that is using http but not in a link. allow_url_include basically lets you include some PHP from a remote site, which is indeed bad, but he might just be using it wrong.
If the theme was freely available, I could look at it and give you more information. Is this theme available for download?
Related Posts:
- Memory errors with media upload, WordPress can’t use more than 96M (while there’s 512 available!)
- Set WP_MAX_MEMORY_LIMIT higher than PHP.ini memory_limit
- WordPress Ignoring .user.ini
- adding custom user input fields in WordPress admin dashboard gives error The link you followed has expired. Please try again
- WP & Server Speed [Teacher Question]
- PHP E_WARNING being shown despite php.ini [closed]
- WordPress upload file size error even after raising php limits
- php_gd2 extension not loading on Windows
- Maximum file Upload
- How does WordPress rewrite URLS using its PHP scripts
- How to fix UpdraftPlus’s memory issue?
- WordPress article with 50 000 words loading slow – 100% cpu
- Restricting page by user role
- The correct method to pass query vars in AJAX using ajaxurl
- Display user’s total comment count outside The Loop
- Getting the action’s tag name within the action
- Admin Bar (Toolbar) not showing on custom PHP file that loads WordPress
- How to add query vars with paginated URLs?
- wordpress separate registration for different roles
- How to get user by display_name with WP_User_Query
- Changing Link Attributes for Wp_Link_Pages
- Unusable menus and “Illegal widget setting ID: nav_menu_item[]” error
- How to change
- Get only the grandchildren, not the direct children of page/current page?
- Passing POST data from one WP post to another
- Use wp_remote_get to get JSON instagram feed from public profile
- How to add SVG icon above product tab title
- WP_Query sort using multiple numeric meta values
- Call to undefined function issue
- wp_insert_post() is returning the correct post ID, no failure, but the post content does not get updated
- How can I generate random numbers inside my shortcodes on each implementation?
- custom widget on the footer
- WordPress automatically adding html tag around PHP code
- WordPress does not load page.php, return 404.php
- Converting HTML Template to WordPress Theme
- How to hide all child pages with post_query?
- Saving an array of dynamic repeater data as post_meta
- How can I apply_filters from inside a function?
- Image rotation and editing stopped working in WordPress after upgrading Ubuntu from 16.04 to 18.04
- WordPress asks you for your FTP details if you want to run Automatic Updates/Upgrade Plugins
- Populate editor with some content of a page with a page template
- I want to load in a new class but only if the current page is single-movies.php
- Using $wpdb (WPDB class) ‘replace’ with multiple WHERE criteria problem
- Skt full width basic slideshow problem
- How to create an ACF shortcode with Repeater Field in WordPress? [duplicate]
- get_template_part() not firing within a switch statement when template has new WP_Query
- get comment data using comment id
- how to get serialized post meta
- Only show size attributes in product box woocommerce when available
- Can I set up a hover animation in CSS depending on a PHP conditional?
- WP check_ajax_referer() is not working
- How to access or parse key/values that have “string”
- Function for simple math doesn’t work what am I doing wrong? [closed]
- Will I have problem with PHP 5.5 and WordPress 4.9.4?
- How do i wrap woocomerce attribute in list?
- Removing files programmatically
- Trying to run website a php file is blank
- exclude custom post type from running a function
- Create condition for Author bio Social Links
- Redirecting visitor from foreign domain with WP content as referrer
- Call to “admin_notices” hook from a static method
- wp_query – Exclude the first thumbnail from lazy loading on archives
- Running SMTP Conditionally
- Change lost password url to a mailto URL in WordPress
- Usermeta data unserialize, extract and display in table in WordPress
- How to let mobile navigation menu close when link is clicked?
- How to transfer variables from one function to another [closed]
- Displaying SQL query result from user input via wpdb
- Display specific page if user signed in
- 500 Error, Get custom field and returning it
- How do I add this OnClick event script to a custom button I’ve created?
- wordpress dependent dropdownlist using post type is not working
- Post content, PHP help
- How to insert text into post based on category – via single.php file
- How to add Open/Close Toggle button into Twenty Fifteen theme for hiding left sidebar?
- str_replace not preserving whitespace
- how to get buddy press messages based on thready_id?
- Unable to pass variable to database
- Child theme functions.php file change database entries
- Get dimensions of logo
- How to call javascript function (jquery) in a shortcode?
- Add custom filter to register data in array
- Rename Index.php
- Metabox Input Not saving
- Run A Pre-Built Core PHP Application Under A WordPress Page or Post Route
- show/hide attachments
- WP_Query based on another query on the page
- Cross origin ajax request always returns 0 when calling get_current_user_id();
- How to print array of specific item
- js code not stored in database currectly
- how to indicate on post listing title if user already liked this post
- wordpress – page not loading (404) even if it’s there
- if is specific custom post in cpt
- Trying to add taxonomy terms to search results page
- Run a WordPress blog (subdirectory) in a Laravel WebApp – SEO Concerns
- custom AJAX filtering logic and outputting results into an Elementor Loop Grid widget
- translating a custom taxonomy term in a shortcode
- how can I get the selected term of a custom taxonomy
- WP Bootstrap NavWaker: Dropdown Menu Opens All Dropdown Menus at Once
- Translating the “Everything” filter menu in Quicksand jquery file