Description
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.
Remediation
References
Related Vulnerabilities
WebLogic CVE-2023-21960 Vulnerability (CVE-2023-21960)
WordPress Plugin Easy Panorama Cross-Site Scripting (1.1.4)
WordPress Plugin MailChimp for WooCommerce Local File Inclusion (2.1.1)
Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-0272)
WordPress Plugin LiveChat-WP live chat Cross-Site Scripting (3.7.3)