wp-h5vp-fpd: WordPress H5VP Plugin - Full Path Disclosure

id: wp-h5vp-fpd

info:
  name: WordPress H5VP Plugin - Full Path Disclosure
  author: theamanrawat
  severity: low
  description: |
    The WordPress H5VP video plugin diclosed full server paths in stack traces when processing video requests.
  reference:
    - https://wordpress.org/plugins/html5-video-player/
  tags: misconfig,wordpress,plugin,h5vp,disclosure,fpd

variables:
  name: '{{randstr}}'

http:
  - raw:
      - |
        POST /wp-json/h5vp/v1/video HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"title":"{{name}}","type":"youtube","src":"{{name}}","user_id":"1"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains_all(body, "Uncaught Error", "html5-video-player", "VideoController.php")'
          - 'contains(content_type, "application/json")'
        condition: and
# digest: 4a0a00473045022100b76a5f361bd62f6cec13bc127f2f62f51af6406a12d194b00bace02eac9c768f02206280890dd4c7e4d1d202ec9cef75ea67d65cd4bb019717b1da34fc37af5a8bb0:922c64590222798bb761d5b6d8e72950