wordpress Bug / Vulnerability

[mohanpendyala]

Vulnerable Path: wp-content/uploads/dump.sql

Google Dorks:
inurl:uploads"dump.sql"wordpress

inurl:wp-content/uploads/dump.sql

This vulnerable path revealing important data which contains Database info, Users emails, password hashes, registered emails and more sensitive data

[rmccue]

Firstly, security issues should be reported via the ​correct private channels.

Secondly, this is not something that WordPress has included in the core code, this is probably from plugins.

[SergeyBiryukov]

That file appears to be created by WP Easy Backup plugin:
​http://plugins.trac.wordpress.org/browser/wp-easy-backup/trunk/wp-easy-backup.php?rev=501744#L37