HexBrain

drchrono · Report #143064

Information Disclosure

Validstatus
11upvotes
31 Jul 2016disclosed

How it was found

Hey,

I found Following Security issue on your site.

Information Disclosure :-

your Wordpress installation in Disclosing its version Number in https://drchrono.com/blog/readme.html This can a hacker in speeding up the process or information gathering though discovering your wordpress version number a attacker could use specific exploits made just for your version.

Missing Best Practice :-

There are Two outdated plugins in your Wordpress site

             1.  Wordpress-importer
              2.  Wufoo-shortcode

This could Serve as a Potential Thread to your site because outdated plugins are often Vulnerable to attacks and could also be vulnerable to 0days

The Website Plugins Should be update regularly to prevent your site from getting attacked.

Prove of Concept :-

https://drchrono.com/blog/wp-content/plugins/wufoo-shortcode/readme.txt https://drchrono.com/blog/wp-content/plugins/wordpress-importer/readme.txt

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original