Description
WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message.
References
- 20070308 Re: Word Press Sensitive Directory exposure (SQL) mailing-list
- 20070308 Word Press Sensitive Directory exposure (SQL) mailing-list
- 24566 third-party-advisory
- wordpress-adminfunctions-sql-injection(32881) vdb-entry
- GLSA-200703-23 vendor-advisory