The server's full path is disclosed

What Wordfence found

A request produced output containing the server's real path, such as /home/username/public_html/. This normally comes from a PHP warning being displayed rather than logged.

Why it matters

On its own this discloses very little. It matters as an ingredient: several exploitation techniques need to know the absolute path, and it also tells an attacker the hosting account name. It is genuinely low severity — worth fixing, not worth waking anyone up for.

How to fix it

1. 1Turn off display_errors in production and log errors to a file instead.
2. 2Set WP_DEBUG to false and WP_DEBUG_DISPLAY to false in wp-config.php.
3. 3Make sure the log file itself is not web-accessible, or you have traded a small problem for a larger one.
4. 4Re-request the URL to confirm the path no longer appears.

How WPSecureOps treats it

The connector reports this as wpscan_fullPathDiscl. WPSecureOps files it under Public files and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.