wordpress-wp-env-exposure: WordPress Configuration wp-env - Exposure

id: wordpress-wp-env-exposure

info:
  name: WordPress Configuration wp-env - Exposure
  author: 0x_Akoko
  severity: low
  description: |
    Detected the WordPress wp-env.json configuration file publicly accessible, potentially revealing the PHP version, installed plugins, themes, and development environment details.
  reference:
    - https://developer.wordpress.org/block-editor/reference-guides/packages/packages-env/
  metadata:
    verified: true
    max-request: 1
  tags: wp,wordpress,config,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.wp-env.json"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "len(body) > 10"
          - "contains(content_type, 'application/json')"
        condition: and

      - type: word
        part: body
        words:
          - '"phpVersion"'
          - '"plugins"'
          - '"themes"'
        condition: and
# digest: 4b0a00483046022100f1d94b6aa2ff9378750785220989778d50af3628aff0bb1578cabeca8a8ffa5e022100b33feced469704b6a4d104954227cdda0e559ad7129efa1f879c43f01f001c21:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.