Exposed wp-config.php file

How it was found

Description:

Hi team! A copy of the WordPress config file wp-config.php has been found at █████████ endpoint. It contains sensitive information, such as MySQL and AWS credentials, and various keys. This domain is in scope, I already had to reports accepted in this domain.

References

████████

Impact

The page provides information to any user get a RCE without any problem.

System Host(s)

████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Open the link:

█████████

And see the file.

Suggested Mitigation/Remediation Actions

Implement access control.