The server's full path is disclosed

The file wp-includes/rss-functions.php contains a Full Path Disclosure vulnerability.

What Wordfence found

A request produced output containing the server's real path, such as /home/username/public_html/. This normally comes from a PHP warning being displayed rather than logged.

Why it matters

On its own this discloses very little. It matters as an ingredient: several exploitation techniques need to know the absolute path, and it also tells an attacker the hosting account name. It is genuinely low severity — worth fixing, not worth waking anyone up for.

How to fix it

1. 1Turn off display_errors in production and log errors to a file instead.
2. 2Set WP_DEBUG to false and WP_DEBUG_DISPLAY to false in wp-config.php.
3. 3Make sure the log file itself is not web-accessible, or you have traded a small problem for a larger one.
4. 4Re-request the URL to confirm the path no longer appears.

Common questions

This looks minor. Why does it get flagged at all?

Alone it is minor — an attacker learns /home/youruser/public_html/. It matters as a building block: several attack classes (log poisoning, some LFI and SQL-injection techniques) need the absolute server path to work. Scanners collect it early precisely because it upgrades other holes later.

What actually leaks the path?

PHP error messages rendered to the page: a warning or notice includes the full path of the file that raised it. Anything that can provoke an error on your site — a malformed parameter, direct access to an include file — turns into a path oracle when display_errors is on.

What is the fix?

Turn error display off in production: display_errors = Off in PHP configuration, and WP_DEBUG false (or WP_DEBUG_DISPLAY false) in wp-config.php. Errors should go to a log, not the response. This is a one-line server hygiene fix — the rare finding that is genuinely five minutes.

How WPSecureOps treats it

The connector reports this as wpscan_fullPathDiscl. WPSecureOps files it under Public files and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.

1. Wordfence: How to interpret scan results
2. WordPress Developer Resources: Hardening WordPress
3. Wordfence: If your site is hacked