Sensitive Data Exposure via wp-config.php file

Disclosed: 2023-05-15 15:04:32 By 0r10nh4ck To deptofdefense
Critical
Vulnerability Details
**Description:** Hi team, A copy of the WordPress config file wp-config.php has been found at █████████ endpoint. It contains sensitive information, such as MySQL and AWS credentials, and various keys. ## References https://codex.wordpress.org/WordPress_Files ## Impact The page provides information to users who do not need it. ## System Host(s) ████████ ## Affected Product(s) and Version(s) ## CVE Numbers ## Steps to Reproduce 1. Go to: ███/wp-config.php_ 2. See the information. ## Suggested Mitigation/Remediation Actions Implement access control.
Actions
View on HackerOne
Report Stats
  • Report ID: 1912671
  • State: Closed
  • Substate: resolved
  • Upvotes: 6
Share this report