WordPress Setup Configuration File

Summary #

Netsparker detected a WordPress setup configuration file.

Impact #

This is the setup URL that new installations of WordPress use. If the attacker finds that URL and it contains a setup page, it indicates that someone has recently installed WordPress on their server but has not yet configured it. At this point, it is very easy for an attacker to take over not just the new WordPress website, but the entire hosting account and all other websites on that hosting account.

Remediation #

If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing for it.

order deny,allow
deny from all
allow from <your ip>

Classifications #

PCI v3.1-6.5.8, PCI v3.2-6.5.8, CAPEC-212, CWE-665, HIPAA-665, ISO27001-A.18.1.3, WASC-14, OWASP 2013-A5, OWASP 2017-A6 , CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/CR:H/IR:H/AR:H/MAV:N/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:N