Sensitive Data Exposure via wp-config.php file
Critical
Vulnerability Details
**Description:**
Hi team,
A copy of the WordPress config file wp-config.php has been found at █████████ endpoint. It contains sensitive information, such as MySQL and AWS credentials, and various keys.
## References
https://codex.wordpress.org/WordPress_Files
## Impact
The page provides information to users who do not need it.
## System Host(s)
████████
## Affected Product(s) and Version(s)
## CVE Numbers
## Steps to Reproduce
1. Go to: ███/wp-config.php_
2. See the information.
## Suggested Mitigation/Remediation Actions
Implement access control.
Actions
View on HackerOneReport Stats
- Report ID: 1912671
- State: Closed
- Substate: resolved
- Upvotes: 6