id: wp-newsletter-fpd

info:
  name: WordPress Plugin Newsletter - Full Path Disclosure
  author: DhiyaneshDk
  severity: low
  description: |
    WordPress Plugin Newsletter plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly.
  reference:
    - https://wordpress.org/plugins/newsletter/
  metadata:
    max-request: 1
    verified: true
    shodan-query: html:"/plugins/newsletter/"
  tags: debug,wordpress,fpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/newsletter/admin.php"
      - "{{BaseURL}}/wp-content/plugins/newsletter/emails/blocks/footer/block.php"
      - "{{BaseURL}}/wp-content/plugins/newsletter/emails/blocks/cta/block.php"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "/plugins/newsletter/")'
          - 'contains_all(body, "Fatal error", "Uncaught Error:")'
        condition: and
# digest: 490a004630440220073814c58d4a3db2335987604b3f7a0caed4a2844c9f4883b5403f88b4894ad502203ba193b0134f194f9db303bb334ee0f4b1723e252cf0f8ae4faec18a64a92aa4:922c64590222798bb761d5b6d8e72950