From 73a04ab1967088d56995bb5882b4f556110bc566 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Mon, 26 Jan 2026 17:28:54 +0530 Subject: [PATCH] WordPress Simple Social Icons - Full Path Disclosure --- .../wordpress-simple-social-icons-fpd.yaml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 http/misconfiguration/wordpress/wordpress-simple-social-icons-fpd.yaml diff --git a/http/misconfiguration/wordpress/wordpress-simple-social-icons-fpd.yaml b/http/misconfiguration/wordpress/wordpress-simple-social-icons-fpd.yaml new file mode 100644 index 00000000000..5be43dee890 --- /dev/null +++ b/http/misconfiguration/wordpress/wordpress-simple-social-icons-fpd.yaml @@ -0,0 +1,28 @@ +id: wordpress-simple-social-icons-fpd + +info: + name: WordPress Simple Social Icons - Full Path Disclosure + author: DhiyaneshDk + severity: low + description: | + WordPress Plugin Simple Social Icons files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. + reference: + - https://wordpress.org/plugins/simple-social-icons/ + metadata: + verified: true + max-request: 1 + publicwww-query: "/plugins/simple-social-icons" + tags: wp,wordpress,wp-plugin,fpd,simple-social-icons,misconfig + +http: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/simple-social-icons/simple-social-icons.php" + + matchers: + - type: dsl + dsl: + - 'status_code == 200 || status_code == 500' + - 'contains(body, "simple-social-icons")' + - 'contains_all(body, "Fatal error", "Uncaught Error") || contains_all(body, "Warning:","failed to open stream")' + condition: and