wp-config.php.bak Vulnerability: The Silent Credential Leak Compromising WordPress Sites Worldwide

Last updated: July 2026  |  Reading time: 14 minutes  |  Category: WordPress Security

What Is wp-config.php.bak and Why Should You Care?

Every WordPress installation ships with a wp-config.php file — the single most sensitive file in your entire WordPress directory. It contains your database hostname, database name, database username, database password, WordPress authentication keys, secret salts, debug flags, and sometimes even FTP credentials and custom constant definitions that control authentication endpoints.

When WordPress core updates, certain plugins, or some hosting control panels modify wp-config.php, they often create an automatic backup by copying the original file and appending a .bak extension. The result is wp-config.php.bak — sitting in your public document root, frequently world-readable, and frequently forgotten.

This is not a theoretical risk. Since 2019, security researchers have documented thousands of real-world compromises that began with a simple HTTP GET request to example.com/wp-config.php.bak. The file returns plaintext — no encoding, no obfuscation, no authentication gate. Attackers automate these requests at scale, and credential harvesting lists are routinely traded on underground forums.

The Anatomy of Exposure

A single wp-config.php.bak file typically exposes the following data points in readable text:

• DB_NAME — reveals the exact database name, enabling targeted SQL injection attempts against other services using the same database server.
• DB_USER and DB_PASSWORD — grant direct database access, bypassing WordPress entirely.
• Auth Keys and Salts — allow session forgery and cookie hijacking, letting an attacker impersonate any user, including administrators.
• WP_DEBUG — when enabled in the .bak, confirms that debug mode was active, signaling a development or poorly maintained environment.
• Custom Constants — some hosts embed API keys, third-party service tokens, or internal paths that expand the attack surface.

How the wp-config.php.bak Vulnerability Works

Creation Vectors

Understanding how these files are created is essential to eliminating them. The primary creation vectors include:

The Attack Chain

The exploitation of a wp-config.php.bak file follows a straightforward but devastating chain:

1. Discovery — Automated scanners crawl the internet looking for .bak, .old, .orig, and similar backup file patterns. Tools like dirb, gobuster, and commercial vulnerability scanners include wp-config.php.bak in their default wordlists.
2. Harvesting — Upon successful retrieval, the attacker extracts database credentials, salts, and keys in seconds.
3. Exploitation — Credentials are used directly against the database via MySQL connection tools, or the authentication keys are used to forge WordPress admin cookies.
4. Lateral Movement — Database access often reveals other tables, and if the database server is shared (common in managed hosting), additional sites become compromised.
5. Persistence — Attackers inject backdoors, redirect rules, or malicious admin users to maintain access even after the original vulnerability is patched.

Data Comparison: wp-config.php.bak vs. Other Common WordPress Exposures

The following comparison evaluates wp-config.php.bak against other well-known WordPress information disclosure vulnerabilities using standardized risk criteria.