Description
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.
Remediation
References
Related Vulnerabilities
MySQL CVE-2023-22059 Vulnerability (CVE-2023-22059)
WordPress Plugin LeadConnector Security Bypass (1.7)
Oracle Database Server CVE-2008-0340 Vulnerability (CVE-2008-0340)
Grafana Insufficiently Protected Credentials Vulnerability (CVE-2019-15635)
WordPress Plugin MAZ Loader-Preloader Builder for WordPress SQL Injection (1.3.2)