---
title: "WEB-CMS-004 CMS Configuration Readable by All Users"
canonical: https://openvapt.com/checks/WEB-CMS-004.html
html: https://openvapt.com/checks/WEB-CMS-004.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-CMS-004 CMS Configuration Readable by All Users

Checks whether wp-config.php, Joomla configuration.php or Drupal settings.php can be read by every local user.

- Domain: Web Apps
- Severity: High
- Control category: Access Control
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-732, CWE-260
- OWASP Top 10 2021: A05:2021
- OWASP WSTG v4.2: WSTG-CONF-09
- NIST SP 800-53 Rev. 5: AC-3, SC-28

## Why It Matters

These files hold the database password and the keys that sign logins. If every account on the machine can read them, any other site, user or compromised process on the server can take over the CMS and its data.

## How It Detects

Finds the configuration files through the local web roots (WordPress also one folder above the root) and reads their permission bits. Fails when the world-read bit is set.

## How to Fix

chmod 640 <file> and chown it to the site owner with the web server's group (for example chown deploy:www-data wp-config.php); on PHP-FPM pools that run as the site user, 600 or 400 also works. Rotate the database password if other people have shell access.

## How to Verify

```
stat -c '%a %U:%G %n' <file>  shows 640, 600 or 400.
```

## Learn the Theory

- [P6 Information Exposure and Misconfiguration](https://openvapt.com/academy/p6.md)
- [P14 CMS Hardening in Depth: WordPress, Joomla and Drupal](https://openvapt.com/academy/p14.md)

## References

- [WordPress Developer Resources, Hardening WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/)
- [Drupal.org, Securing file permissions and ownership](https://www.drupal.org/docs/administering-a-drupal-site/security-in-drupal/securing-file-permissions-and-ownership)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go

Run it: `openvapt scan --only WEB-CMS-004`. Read it offline: `openvapt explain WEB-CMS-004`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-CMS-004.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.