[Full-disclosure] Full Path Disclosure in most wordpress' plugins [?]

Hash: SHA1

Exists an call to add_action() without validate with function_exists().
When I run the php script directly, I get the full path of wp installation.

[+] http://www.marco2010.cl/wp-content/plugins/akismet/akismet.php
[+] http://www.marco2010.cl/wp-content/plugins/hello.php

Is a bug? Is a feature?

More details posted in my blog:

- --
Desarrollador y Programador Web
Seguridad Informatica
Linux User #382319
Blog: http://blog.zerial.org
Skype: erzerial
Jabber: zerial@xxxxxxxxxxxx
GTalk && MSN: fernando@xxxxxxxxxx

Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: Window sizing buttons
    ... Herb Tyson MS MVP ... Blog: http://word2007bible.herbtyson.com ... Before trying that, however, I would try creating a new Windows user on ... amiss with your installation on that computer, almost as if one of the ...
  • Re: Cant get outlook express for SERVICE PACK 2, so how do I get i
    ... After my 4th installation I have been able to get ... My Blog, Defending Your Machine, ... || once had in Outlook Express but imported to Outlook and archived! ...
  • Re: Ausschaltproblem
    ... Hast du die Installation noch einmal mit der 64bit ... nach was für Hardware du wirklich auf den fraglichen Maschinen hast. ... This message is signed using GnuPG, ... Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ ...
  • Re: Spelling Grammar Dialog Box Explain button missing
    ... I wasn't talking about putting a new installation on the machine... ... Herb Tyson MS MVP ... Blog: http://word2007bible.herbtyson.com ...
  • Re: Update rollup 2 -Arrons blog
    ... Continue researching Aaron Stebner's blog. ... have been bugged with a RollUp 2 installation problem. ... For your version of Media Center ...