Permissions for the xmlrpc.php file

Some of my ecto users had to use 777 permissions to get xmlrpc.php working. How much of a security risk are these permissions? Any suggestions, advice welcome.