Sensitive Data Exposure via wp-config.php file

How it was found

Description:

Hi team, A copy of the WordPress config file wp-config.php has been found at █████████ endpoint. It contains sensitive information, such as MySQL and AWS credentials, and various keys.

References

https://codex.wordpress.org/WordPress_Files

Impact

The page provides information to users who do not need it.

System Host(s)

████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1. Go to: ███/wp-config.php_
2. See the information.

Suggested Mitigation/Remediation Actions

Implement access control.