I'm penetration testing a website for a friend. It runs on WP and has directory indexing enabled. I would like to provide a PoC of why this is an issue, but I've never used Wordpress so I don't know what a sensitive directory on it is.
What are some sensitive wordpress directories that shouldn't be publicly accessible? Only one I've gotten into is wp-content, but it simply contains photos.
On Wordpress, user-generated content is supposed to go into /wp-content while other file names and directories (content inside /wp-admin, /wp-includes) are mostly static and predictable as they belong to the Wordpress core.
Directory listing inside /wp-content can help you enumerate uploaded media files (/uploads), themes (/themes) and most importantly plugins (/plugins). Being able to list all installed plugins without tedious guessing helps to quickly identify outdated versions - which is a great advantage since vulnerable plugins are one of the most common entry points. I've also seen some plugins use their own caching mechanisms and store potentially sensitive data in files with randomized names. A /tmp directory inside /wp-content is common, too.
While that's not limited to Wordpress, you might also stumble upon database backups or legacy files with changed names (e.g. wp-config.php_old) that you wouldn't discover by brute forcing paths. To identify all user-generated files I'd suggest you simply spider the index and diff the directory structure against a default installation.
But although directory listing on Wordpress facilitates information gathering, it usually doesn't pose an immediate, exploitable threat.
wp-content is used to store assets of a website like images, plugins, themes etc.,
By revealing this info (Information disclosure) you will make an attacker's job easy to see which version of plugins, themes etc are installed and hence can find attack vector pretty easily. It might even help him to pinpoint if his attack worked like Local File Include etc.,
In general, it's a good practice to not have any directory traversal to increase the difficulty of an attacker.
Try running wpscan against the site and analyze the results. wpscan also contains a list of vulnerabilities it checks against and it includes interesting directories as well.
