I'm penetration testing a website for a friend. It runs on WP and has directory indexing enabled. I would like to provide a PoC of why this is an issue, but I've never used Wordpress so I don't know what a sensitive directory on it is.

What are some sensitive wordpress directories that shouldn't be publicly accessible? Only one I've gotten into is wp-content, but it simply contains photos.

  • In short, directory listing (indexing) is vulnerability itself. It should never be allowed directly on the web server.
    – Fis
    May 29, 2017 at 10:40
  • 2
    @Fis It's often undesirable and can eventually be a security risk, but it's not a vulnerability per se. I find "never" too strong.
    – Arminius
    May 29, 2017 at 11:19
  • @Arminus It is usually considered as configuration vulnerability (A.5 of OWASP) because of sensitive information disclosure. I would rank it as low - to medium.
    – Fis
    May 29, 2017 at 11:24
  • 3
    I'm absolutely fine with a public download directory that has directory listing turned on.
    – Arminius
    May 29, 2017 at 11:37

2 Answers 2


On Wordpress, user-generated content is supposed to go into /wp-content while other file names and directories (content inside /wp-admin, /wp-includes) are mostly static and predictable as they belong to the Wordpress core.

Directory listing inside /wp-content can help you enumerate uploaded media files (/uploads), themes (/themes) and most importantly plugins (/plugins). Being able to list all installed plugins without tedious guessing helps to quickly identify outdated versions - which is a great advantage since vulnerable plugins are one of the most common entry points. I've also seen some plugins use their own caching mechanisms and store potentially sensitive data in files with randomized names. A /tmp directory inside /wp-content is common, too.

While that's not limited to Wordpress, you might also stumble upon database backups or legacy files with changed names (e.g. wp-config.php_old) that you wouldn't discover by brute forcing paths. To identify all user-generated files I'd suggest you simply spider the index and diff the directory structure against a default installation.

But although directory listing on Wordpress facilitates information gathering, it usually doesn't pose an immediate, exploitable threat.


wp-content is used to store assets of a website like images, plugins, themes etc.,

By revealing this info (Information disclosure) you will make an attacker's job easy to see which version of plugins, themes etc are installed and hence can find attack vector pretty easily. It might even help him to pinpoint if his attack worked like Local File Include etc.,

In general, it's a good practice to not have any directory traversal to increase the difficulty of an attacker.

Try running wpscan against the site and analyze the results. wpscan also contains a list of vulnerabilities it checks against and it includes interesting directories as well.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .