Description
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.
Remediation
References
Related Vulnerabilities
IBM WebSEAL Incorrect Default Permissions Vulnerability (CVE-2023-38370)
WordPress Plugin Fast Velocity Minify Information Disclosure (2.7.6)
Zenphoto Improper Privilege Management Vulnerability (CVE-2018-0610)
SharePoint Out-of-bounds Read Vulnerability (CVE-2026-56192)
WordPress Plugin Social Media Share Buttons & Social Sharing Icons Cross-Site Scripting (2.1.7)