WordPress Version Exposure via ███████ on hemi.xyz

How it was found

Summary:

The WordPress CMS version is exposed in the XML file at https://hemi.xyz███. This disclosure allows attackers to fingerprint the CMS version, potentially leading to targeted exploitation if known vulnerabilities exist for this specific version

Steps To Reproduce:

Navigate to [https://hemi.xyz███████]. Observe the raw XML response displayed in the browser. Locate the <head> section within the XML document. Find the exposed CMS version, which reveals the exact WordPress version running on the site.

Impact

Summary:

Attackers can identify outdated versions and look for known vulnerabilities.
Can assist fingerprinting and enumeration attacks against the website.
If the CMS is outdated, this increases the risk of exploitation